Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Angular uses a DI container (the platform injector) to hold     request-specific state during server-side rendering. For historical reasons, the container was stored as a     JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could     inadvertently share or overwrite the global injector state. In practical terms, this can lead to one     request responding with data meant for a completely different request, leaking data or tokens included on     the rendered page or in response headers. As long as an attacker had network access to send any traffic     that received a rendered response, they may have been able to send a large number of requests and then     inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and     `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in     all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-     server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and     18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any     asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application     code, and/or ensure that the server build defines `ngJitMode` as false. (CVE-2025-59052)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold
    request-specific state during server-side rendering. For historical reasons, the container was stored as a
    JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could
    inadvertently share or overwrite the global injector state. In practical terms, this can lead to one
    request responding with data meant for a completely different request, leaking data or tokens included on
    the rendered page or in response headers. As long as an attacker had network access to send any traffic
    that received a rendered response, they may have been able to send a large number of requests and then
    inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and
    `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in
    all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-
    server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and
    18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any
    asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application
    code, and/or ensure that the server build defines `ngJitMode` as false. (CVE-2025-59052)

ID	Name	Product	Family	Type	Severity
264809	Linux Distros Unpatched Vulnerability : CVE-2025-59052	Nessus	Misc.	Local	high
435253	SCA: security update for @angular/platform-server, @angular/ssr (GHSA-68x2-mx4q-78m7)	Tenable Cloud Security	SCA Checks	Local	high
435253	SCA: security update for @angular/platform-server, @angular/ssr (GHSA-68x2-mx4q-78m7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-59052

high

Tenable Plugins

high

high

high