Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Description

Angular uses a DI container (the “platform injector”) to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 16.0.0-next.0, <= 16.2.0

References

• GHSA-68x2-mx4q-78m7
• CVE-2025-59052
• CWE-362
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739
• @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrac - CVE-2025-25290
• OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
• @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nguniversal/common