Summary
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
An incomplete fix for GHSA-58c5-g7wp-6w37 (CVE-2025-66035) in @angular/common's HTTP Client (HttpClient) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.
Technical Description
To address CVE-2025-66035, xsrfInterceptorFn introduced a regular expression (const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i) to detect and skip absolute and protocol-relative URLs before attaching the X-XSRF-TOKEN header.
However, browsers resolve request URLs passed to fetch() and XMLHttpRequest.open() using the WHATWG URL parser. For http: and https: schemes, the WHATWG URL standard performs several normalizations prior to resolving the authority/origin:
- Backslashes (
\) are treated as forward slashes (/), e.g.,/\evil.example/x,\\evil.example/x,\/evil.example/x,https:\\evil.example/x,https:/\evil.example/x. - Leading and trailing C0 control characters and spaces (
<= 0x20) are stripped, e.g.,' //evil.example/x','\0//evil.example/x','\x1f//evil.example/x'. - ASCII tab (
\t), newline (\n), and carriage return (\r) characters are removed anywhere in the input, e.g.,'/\t/evil.example/x','/\n/evil.example/x','htt\tps://evil.example/x'.
Because these URLs do not match /^(?:https?:)?\/\//i, xsrfInterceptorFn treats them as relative same-origin URLs and attaches the X-XSRF-TOKEN header, while the browser resolves and dispatches the request to the cross-origin host (evil.example).
Note: Angular 21.0.3+ and 22.x replaced the regular expression with a WHATWG new URL(req.url, locationOrigin) origin comparison in #65683 and were already unaffected. However, the 20.3.x LTS branch retained the regular expression until 20.3.34.
Attack Preconditions
- The victim's Angular application must have XSRF protection enabled (enabled by default in
HttpClient). - The attacker must be able to make the application send a state-changing HTTP request (e.g.,
POST,PUT,DELETE,PATCH) to a URL they control (such as/\attacker.example/apior//attacker.example/api).
Workarounds
If you cannot immediately upgrade to a patched version:
- Validate and normalize outgoing request URLs using
new URL(url, window.location.origin)and verify thatparsedUrl.origin === window.location.originbefore passing dynamic URLs to mutatingHttpClientrequests. - Avoid passing untrusted or user-controlled URLs to
HttpClientmutating methods.
Impact
The token leakage bypasses Angular's built-in XSRF protection on affected versions, allowing an attacker to capture the user's valid X-XSRF-TOKEN header if their server permits the request and custom header via CORS. Once obtained, the attacker can perform Cross-Site Request Forgery (CSRF) attacks against the victim user's session.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The issue is resolved by parsing and comparing the request URL's origin against the application's current origin using the standard URL constructor (new URL(req.url, locationOrigin)).
21.0.3(and all22.xreleases)20.3.34
Frequently Asked Questions
- What is CVE-2026-111753? CVE-2026-111753 is a medium-severity security vulnerability in @angular/common (npm), affecting versions >= 21.0.0, < 21.0.3. It is fixed in 21.0.3, 20.3.34.
- Which versions of @angular/common are affected by CVE-2026-111753? @angular/common (npm) versions >= 21.0.0, < 21.0.3 is affected.
- Is there a fix for CVE-2026-111753? Yes. CVE-2026-111753 is fixed in 21.0.3, 20.3.34. Upgrade to this version or later.
- Is CVE-2026-111753 exploitable, and should I be worried? Whether CVE-2026-111753 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-111753 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-111753?
- Upgrade
@angular/commonto 21.0.3 or later - Upgrade
@angular/commonto 20.3.34 or later
- Upgrade