Angular SSR Vulnerability Allows Attackers to Access Sensitive Data

A high vulnerability in Angular’s server-side rendering (SSR) feature can lead to sensitive data exposure when multiple requests are handled concurrently, tracked as CVE-2025-59052. The flaw stems from a global race condition in the platform injector, which may cause leakage of request-specific data such as authentication tokens or user-specific settings across sessions.

The issue is rated 7.1 high on the CVE scale, and attackers with network access could exploit it by sending repeated SSR requests and inspecting rendered pages or response headers. The fix involves updates to Angular’s platform-server and related packages, with guidance to upgrade to specific versions and apply code adjustments such as adding a BootstrapContext argument to bootstrapApplication and disabling certain server-side behaviours until patches are in place.

Developers are advised to apply the official updates or workarounds to mitigate data leakage while maintaining per-request data isolation in Angular SSR deployments.