Angular SSR Flaw (CVE-2025-59052) Exposes User Data: What Developers Need to Know

The Angular team has issued a security advisory addressing a high-severity server-side rendering flaw that could allow attackers to access sensitive data from unrelated requests, tracked as CVE-2025-59052 with a CVSS score of 7.1.

According to Angular, the vulnerability stems from a global platform injector race condition in Angular’s dependency injection system, where the container was stored as a JavaScript module-scoped global variable and could be shared or overwritten when multiple requests are processed concurrently. In practice, one user’s response could contain another user’s data, tokens, or headers, exposing private information.

The advisory highlights SSR-specific breaking changes, with affected APIs including bootstrapApplication, getPlatform, and destroyPlatform, and notes that an explicit BootstrapContext parameter is now required, getPlatform may return null in SSR, and destroyPlatform is a no-op. The Angular team has patched the issue across all supported release lines and the upcoming v21 prerelease, and developers can apply fixes via ng update commands.

If immediate updates are not possible, mitigations include disabling SSR, removing asynchronous behaviour from bootstrap functions, eliminating getPlatform usage, and ensuring ngJitMode is false on the server build.