MEDIUM GitHub
CVE-2026-111753
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.
### Technical Description
To address `CVE-2025-66035`, `xsrfInterceptorFn` introd
Affected Products
- npm/@angular/common >= 21.0.0, < 21.0.3
- npm/@angular/common >= 20.0.0, < 20.3.34
- npm/@angular/common <= 19.2.25
References
- https://github.com/advisories/GHSA-jfgx-762w-99vr
- https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr
- https://github.com/angular/angular/pull/65683
- https://github.com/angular/angular/pull/71295
This medium severity vulnerability was published on 2026-10-20 via GitHub. Affected: npm/@angular/common >= 21.0.0, < 21.0.3, npm/@angular/common >= 20.0.0, < 20.3.34, npm/@angular/common <= 19.2.25.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.