{"id":"CVE-2026-111753","aliases":["CLSA-2026-1793093788","CLSA-2026-1793911122","CLSA-2026-1793911707","CLSA-2026-1793917233","CLSA-2026-1793918325","CLSA-2026-1793919513","CLSA-2026-1793920447","CLSA-2026-1793920842","CLSA-2026-1793922812","CLSA-2026-1793926563","CLSA-2026-1793927116","CLSA-2026-1793929486","CLSA-2026-1793930090","CLSA-2026-1793930638","CLSA-2026-1793931669","CLSA-2026-1793932915","CLSA-2026-1793933364","CLSA-2026-1793934035","CLSA-2026-1793934376","CLSA-2026-1793971152","CLSA-2026-1793972347","CLSA-2026-1793974749","CLSA-2026-1793975886","CLSA-2026-1793976490","CLSA-2026-1793976818","CLSA-2026-1794057503","CLSA-2026-1794057714","CLSA-2026-1794058055","CLSA-2026-1794060464","CLSA-2026-1794061344","CLSA-2026-1794061742","CLSA-2026-1794062088","CLSA-2026-1794063077","CLSA-2026-1794066068","EUVD-2026-117786","GHSA-jfgx-762w-99vr"],"status":"published","title":"Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00537,"percentile":0.45756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-201","CWE-359"],"published":"2026-10-20T20:37:57Z","modified":"2026-11-07T19:00:37Z","fixes":[{"ecosystem":"npm","package":"@angular/common","fixed_in":["21.0.3","20.3.34"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.3.34"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.7"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3","19.2.25-tuxcare.4","19.2.25-tuxcare.5","19.2.25-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.7"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2","19.2.25-tuxcare.3","19.2.25-tuxcare.4","19.2.25-tuxcare.5","19.2.25-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.14-tuxcare.0"},{"fixed":"19.2.14-tuxcare.8"}]}],"versions":["19.2.14","19.2.14-tuxcare.1","19.2.14-tuxcare.2","19.2.14-tuxcare.3","19.2.14-tuxcare.4","19.2.14-tuxcare.5","19.2.14-tuxcare.6","19.2.14-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.18-tuxcare.0"},{"fixed":"19.2.18-tuxcare.8"}]}],"versions":["19.2.18","19.2.18-tuxcare.1","19.2.18-tuxcare.2","19.2.18-tuxcare.3","19.2.18-tuxcare.4","19.2.18-tuxcare.5","19.2.18-tuxcare.6","19.2.18-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.13-tuxcare.0"},{"fixed":"18.2.13-tuxcare.7"}]}],"versions":["18.2.13","18.2.13-tuxcare.1","18.2.13-tuxcare.2","18.2.13-tuxcare.3","18.2.13-tuxcare.4","18.2.13-tuxcare.5","18.2.13-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.12-tuxcare.0"},{"fixed":"18.2.12-tuxcare.11"}]}],"versions":["18.2.12","18.2.12-tuxcare.1","18.2.12-tuxcare.10","18.2.12-tuxcare.2","18.2.12-tuxcare.3","18.2.12-tuxcare.4","18.2.12-tuxcare.5","18.2.12-tuxcare.6","18.2.12-tuxcare.7","18.2.12-tuxcare.8","18.2.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.12-tuxcare.0"},{"fixed":"18.2.12-tuxcare.11"}]}],"versions":["18.2.12","18.2.12-tuxcare.1","18.2.12-tuxcare.10","18.2.12-tuxcare.2","18.2.12-tuxcare.3","18.2.12-tuxcare.4","18.2.12-tuxcare.5","18.2.12-tuxcare.6","18.2.12-tuxcare.7","18.2.12-tuxcare.8","18.2.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.12-tuxcare.0"},{"fixed":"18.2.12-tuxcare.11"}]}],"versions":["18.2.12","18.2.12-tuxcare.1","18.2.12-tuxcare.10","18.2.12-tuxcare.2","18.2.12-tuxcare.3","18.2.12-tuxcare.4","18.2.12-tuxcare.5","18.2.12-tuxcare.6","18.2.12-tuxcare.7","18.2.12-tuxcare.8","18.2.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.1.2-tuxcare.0"},{"fixed":"18.1.2-tuxcare.11"}]}],"versions":["18.1.2","18.1.2-tuxcare.1","18.1.2-tuxcare.10","18.1.2-tuxcare.2","18.1.2-tuxcare.3","18.1.2-tuxcare.4","18.1.2-tuxcare.5","18.1.2-tuxcare.6","18.1.2-tuxcare.7","18.1.2-tuxcare.8","18.1.2-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.1.2-tuxcare.0"},{"fixed":"18.1.2-tuxcare.11"}]}],"versions":["18.1.2","18.1.2-tuxcare.1","18.1.2-tuxcare.10","18.1.2-tuxcare.2","18.1.2-tuxcare.3","18.1.2-tuxcare.4","18.1.2-tuxcare.5","18.1.2-tuxcare.6","18.1.2-tuxcare.7","18.1.2-tuxcare.8","18.1.2-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.1.2-tuxcare.0"},{"fixed":"18.1.2-tuxcare.11"}]}],"versions":["18.1.2","18.1.2-tuxcare.1","18.1.2-tuxcare.10","18.1.2-tuxcare.2","18.1.2-tuxcare.3","18.1.2-tuxcare.4","18.1.2-tuxcare.5","18.1.2-tuxcare.6","18.1.2-tuxcare.7","18.1.2-tuxcare.8","18.1.2-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.12-tuxcare.0"},{"fixed":"17.3.12-tuxcare.21"}]}],"versions":["17.3.12","17.3.12-tuxcare.1","17.3.12-tuxcare.10","17.3.12-tuxcare.11","17.3.12-tuxcare.12","17.3.12-tuxcare.13","17.3.12-tuxcare.14","17.3.12-tuxcare.15","17.3.12-tuxcare.16","17.3.12-tuxcare.17","17.3.12-tuxcare.18","17.3.12-tuxcare.2","17.3.12-tuxcare.3","17.3.12-tuxcare.4","17.3.12-tuxcare.5","17.3.12-tuxcare.6","17.3.12-tuxcare.7","17.3.12-tuxcare.8","17.3.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.12-tuxcare.0"},{"fixed":"17.3.12-tuxcare.21"}]}],"versions":["17.3.12","17.3.12-tuxcare.1","17.3.12-tuxcare.10","17.3.12-tuxcare.11","17.3.12-tuxcare.12","17.3.12-tuxcare.13","17.3.12-tuxcare.14","17.3.12-tuxcare.15","17.3.12-tuxcare.16","17.3.12-tuxcare.17","17.3.12-tuxcare.18","17.3.12-tuxcare.2","17.3.12-tuxcare.3","17.3.12-tuxcare.4","17.3.12-tuxcare.5","17.3.12-tuxcare.6","17.3.12-tuxcare.7","17.3.12-tuxcare.8","17.3.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.12-tuxcare.0"},{"fixed":"17.3.12-tuxcare.21"}]}],"versions":["17.3.12","17.3.12-tuxcare.1","17.3.12-tuxcare.10","17.3.12-tuxcare.11","17.3.12-tuxcare.12","17.3.12-tuxcare.13","17.3.12-tuxcare.14","17.3.12-tuxcare.15","17.3.12-tuxcare.16","17.3.12-tuxcare.17","17.3.12-tuxcare.18","17.3.12-tuxcare.2","17.3.12-tuxcare.3","17.3.12-tuxcare.4","17.3.12-tuxcare.5","17.3.12-tuxcare.6","17.3.12-tuxcare.7","17.3.12-tuxcare.8","17.3.12-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.14-tuxcare.0"},{"fixed":"18.2.14-tuxcare.18"}]}],"versions":["18.2.14","18.2.14-tuxcare.1","18.2.14-tuxcare.10","18.2.14-tuxcare.11","18.2.14-tuxcare.12","18.2.14-tuxcare.13","18.2.14-tuxcare.14","18.2.14-tuxcare.15","18.2.14-tuxcare.16","18.2.14-tuxcare.17","18.2.14-tuxcare.2","18.2.14-tuxcare.3","18.2.14-tuxcare.4","18.2.14-tuxcare.5","18.2.14-tuxcare.6","18.2.14-tuxcare.7","18.2.14-tuxcare.8","18.2.14-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.14-tuxcare.0"},{"fixed":"18.2.14-tuxcare.18"}]}],"versions":["18.2.14","18.2.14-tuxcare.1","18.2.14-tuxcare.10","18.2.14-tuxcare.11","18.2.14-tuxcare.12","18.2.14-tuxcare.13","18.2.14-tuxcare.14","18.2.14-tuxcare.15","18.2.14-tuxcare.16","18.2.14-tuxcare.17","18.2.14-tuxcare.2","18.2.14-tuxcare.3","18.2.14-tuxcare.4","18.2.14-tuxcare.5","18.2.14-tuxcare.6","18.2.14-tuxcare.7","18.2.14-tuxcare.8","18.2.14-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.14-tuxcare.0"},{"fixed":"18.2.14-tuxcare.18"}]}],"versions":["18.2.14","18.2.14-tuxcare.1","18.2.14-tuxcare.10","18.2.14-tuxcare.11","18.2.14-tuxcare.12","18.2.14-tuxcare.13","18.2.14-tuxcare.14","18.2.14-tuxcare.15","18.2.14-tuxcare.16","18.2.14-tuxcare.17","18.2.14-tuxcare.2","18.2.14-tuxcare.3","18.2.14-tuxcare.4","18.2.14-tuxcare.5","18.2.14-tuxcare.6","18.2.14-tuxcare.7","18.2.14-tuxcare.8","18.2.14-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.1.0-tuxcare.0"},{"fixed":"17.1.0-tuxcare.10"}]}],"versions":["17.1.0","17.1.0-tuxcare.1","17.1.0-tuxcare.2","17.1.0-tuxcare.3","17.1.0-tuxcare.4","17.1.0-tuxcare.5","17.1.0-tuxcare.6","17.1.0-tuxcare.7","17.1.0-tuxcare.8","17.1.0-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.1.0-tuxcare.0"},{"fixed":"17.1.0-tuxcare.10"}]}],"versions":["17.1.0","17.1.0-tuxcare.1","17.1.0-tuxcare.2","17.1.0-tuxcare.3","17.1.0-tuxcare.4","17.1.0-tuxcare.5","17.1.0-tuxcare.6","17.1.0-tuxcare.7","17.1.0-tuxcare.8","17.1.0-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.1.0-tuxcare.0"},{"fixed":"17.1.0-tuxcare.10"}]}],"versions":["17.1.0","17.1.0-tuxcare.1","17.1.0-tuxcare.2","17.1.0-tuxcare.3","17.1.0-tuxcare.4","17.1.0-tuxcare.5","17.1.0-tuxcare.6","17.1.0-tuxcare.7","17.1.0-tuxcare.8","17.1.0-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.10-tuxcare.0"},{"fixed":"15.2.10-tuxcare.18"}]}],"versions":["15.2.10","15.2.10-tuxcare.1","15.2.10-tuxcare.10","15.2.10-tuxcare.11","15.2.10-tuxcare.12","15.2.10-tuxcare.13","15.2.10-tuxcare.14","15.2.10-tuxcare.15","15.2.10-tuxcare.16","15.2.10-tuxcare.17","15.2.10-tuxcare.2","15.2.10-tuxcare.3","15.2.10-tuxcare.4","15.2.10-tuxcare.5","15.2.10-tuxcare.6","15.2.10-tuxcare.7","15.2.10-tuxcare.8","15.2.10-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.10-tuxcare.0"},{"fixed":"15.2.10-tuxcare.18"}]}],"versions":["15.2.10","15.2.10-tuxcare.1","15.2.10-tuxcare.10","15.2.10-tuxcare.11","15.2.10-tuxcare.12","15.2.10-tuxcare.13","15.2.10-tuxcare.14","15.2.10-tuxcare.15","15.2.10-tuxcare.16","15.2.10-tuxcare.17","15.2.10-tuxcare.2","15.2.10-tuxcare.3","15.2.10-tuxcare.4","15.2.10-tuxcare.5","15.2.10-tuxcare.6","15.2.10-tuxcare.7","15.2.10-tuxcare.8","15.2.10-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.10-tuxcare.0"},{"fixed":"15.2.10-tuxcare.18"}]}],"versions":["15.2.10","15.2.10-tuxcare.1","15.2.10-tuxcare.10","15.2.10-tuxcare.11","15.2.10-tuxcare.12","15.2.10-tuxcare.13","15.2.10-tuxcare.14","15.2.10-tuxcare.15","15.2.10-tuxcare.16","15.2.10-tuxcare.17","15.2.10-tuxcare.2","15.2.10-tuxcare.3","15.2.10-tuxcare.4","15.2.10-tuxcare.5","15.2.10-tuxcare.6","15.2.10-tuxcare.7","15.2.10-tuxcare.8","15.2.10-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.11-tuxcare.0"},{"fixed":"16.2.11-tuxcare.7"}]}],"versions":["16.2.11","16.2.11-tuxcare.1","16.2.11-tuxcare.2","16.2.11-tuxcare.3","16.2.11-tuxcare.4","16.2.11-tuxcare.5","16.2.11-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.11-tuxcare.0"},{"fixed":"16.2.11-tuxcare.7"}]}],"versions":["16.2.11","16.2.11-tuxcare.1","16.2.11-tuxcare.2","16.2.11-tuxcare.3","16.2.11-tuxcare.4","16.2.11-tuxcare.5","16.2.11-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.11-tuxcare.0"},{"fixed":"16.2.11-tuxcare.7"}]}],"versions":["16.2.11","16.2.11-tuxcare.1","16.2.11-tuxcare.2","16.2.11-tuxcare.3","16.2.11-tuxcare.4","16.2.11-tuxcare.5","16.2.11-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.7-tuxcare.0"},{"fixed":"16.2.7-tuxcare.8"}]}],"versions":["16.2.7","16.2.7-tuxcare.1","16.2.7-tuxcare.2","16.2.7-tuxcare.3","16.2.7-tuxcare.4","16.2.7-tuxcare.5","16.2.7-tuxcare.6","16.2.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.7-tuxcare.0"},{"fixed":"16.2.7-tuxcare.8"}]}],"versions":["16.2.7","16.2.7-tuxcare.1","16.2.7-tuxcare.2","16.2.7-tuxcare.3","16.2.7-tuxcare.4","16.2.7-tuxcare.5","16.2.7-tuxcare.6","16.2.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.7-tuxcare.0"},{"fixed":"16.2.7-tuxcare.8"}]}],"versions":["16.2.7","16.2.7-tuxcare.1","16.2.7-tuxcare.2","16.2.7-tuxcare.3","16.2.7-tuxcare.4","16.2.7-tuxcare.5","16.2.7-tuxcare.6","16.2.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.8"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4","19.2.23-tuxcare.5","19.2.23-tuxcare.6","19.2.23-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.8"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4","19.2.23-tuxcare.5","19.2.23-tuxcare.6","19.2.23-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.23-tuxcare.0"},{"fixed":"19.2.23-tuxcare.8"}]}],"versions":["19.2.23","19.2.23-tuxcare.1","19.2.23-tuxcare.2","19.2.23-tuxcare.3","19.2.23-tuxcare.4","19.2.23-tuxcare.5","19.2.23-tuxcare.6","19.2.23-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.2-tuxcare.0"},{"fixed":"15.2.2-tuxcare.9"}]}],"versions":["15.2.2","15.2.2-tuxcare.1","15.2.2-tuxcare.2","15.2.2-tuxcare.3","15.2.2-tuxcare.4","15.2.2-tuxcare.5","15.2.2-tuxcare.6","15.2.2-tuxcare.7","15.2.2-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.2-tuxcare.0"},{"fixed":"15.2.2-tuxcare.9"}]}],"versions":["15.2.2","15.2.2-tuxcare.1","15.2.2-tuxcare.2","15.2.2-tuxcare.3","15.2.2-tuxcare.4","15.2.2-tuxcare.5","15.2.2-tuxcare.6","15.2.2-tuxcare.7","15.2.2-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.2-tuxcare.0"},{"fixed":"15.2.2-tuxcare.9"}]}],"versions":["15.2.2","15.2.2-tuxcare.1","15.2.2-tuxcare.2","15.2.2-tuxcare.3","15.2.2-tuxcare.4","15.2.2-tuxcare.5","15.2.2-tuxcare.6","15.2.2-tuxcare.7","15.2.2-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.12-tuxcare.0"},{"fixed":"16.2.12-tuxcare.18"}]}],"versions":["16.2.12","16.2.12-tuxcare.1","16.2.12-tuxcare.10","16.2.12-tuxcare.11","16.2.12-tuxcare.12","16.2.12-tuxcare.13","16.2.12-tuxcare.14","16.2.12-tuxcare.15","16.2.12-tuxcare.16","16.2.12-tuxcare.17","16.2.12-tuxcare.2","16.2.12-tuxcare.3","16.2.12-tuxcare.4","16.2.12-tuxcare.5","16.2.12-tuxcare.6","16.2.12-tuxcare.7","16.2.12-tuxcare.8","16.2.12-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.12-tuxcare.0"},{"fixed":"16.2.12-tuxcare.18"}]}],"versions":["16.2.12","16.2.12-tuxcare.1","16.2.12-tuxcare.10","16.2.12-tuxcare.11","16.2.12-tuxcare.12","16.2.12-tuxcare.13","16.2.12-tuxcare.14","16.2.12-tuxcare.15","16.2.12-tuxcare.16","16.2.12-tuxcare.17","16.2.12-tuxcare.2","16.2.12-tuxcare.3","16.2.12-tuxcare.4","16.2.12-tuxcare.5","16.2.12-tuxcare.6","16.2.12-tuxcare.7","16.2.12-tuxcare.8","16.2.12-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.12-tuxcare.0"},{"fixed":"16.2.12-tuxcare.18"}]}],"versions":["16.2.12","16.2.12-tuxcare.1","16.2.12-tuxcare.10","16.2.12-tuxcare.11","16.2.12-tuxcare.12","16.2.12-tuxcare.13","16.2.12-tuxcare.14","16.2.12-tuxcare.15","16.2.12-tuxcare.16","16.2.12-tuxcare.17","16.2.12-tuxcare.2","16.2.12-tuxcare.3","16.2.12-tuxcare.4","16.2.12-tuxcare.5","16.2.12-tuxcare.6","16.2.12-tuxcare.7","16.2.12-tuxcare.8","16.2.12-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.21-tuxcare.0"},{"fixed":"19.2.21-tuxcare.10"}]}],"versions":["19.2.21","19.2.21-tuxcare.2","19.2.21-tuxcare.4","19.2.21-tuxcare.5","19.2.21-tuxcare.6","19.2.21-tuxcare.7","19.2.21-tuxcare.8","19.2.21-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.21-tuxcare.0"},{"fixed":"19.2.21-tuxcare.10"}]}],"versions":["19.2.21","19.2.21-tuxcare.2","19.2.21-tuxcare.4","19.2.21-tuxcare.5","19.2.21-tuxcare.6","19.2.21-tuxcare.7","19.2.21-tuxcare.8","19.2.21-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.21-tuxcare.0"},{"fixed":"19.2.21-tuxcare.10"}]}],"versions":["19.2.21","19.2.21-tuxcare.2","19.2.21-tuxcare.4","19.2.21-tuxcare.5","19.2.21-tuxcare.6","19.2.21-tuxcare.7","19.2.21-tuxcare.8","19.2.21-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.9-tuxcare.0"},{"fixed":"15.2.9-tuxcare.9"}]}],"versions":["15.2.9","15.2.9-tuxcare.1","15.2.9-tuxcare.2","15.2.9-tuxcare.3","15.2.9-tuxcare.4","15.2.9-tuxcare.5","15.2.9-tuxcare.6","15.2.9-tuxcare.7","15.2.9-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.9-tuxcare.0"},{"fixed":"15.2.9-tuxcare.9"}]}],"versions":["15.2.9","15.2.9-tuxcare.1","15.2.9-tuxcare.2","15.2.9-tuxcare.3","15.2.9-tuxcare.4","15.2.9-tuxcare.5","15.2.9-tuxcare.6","15.2.9-tuxcare.7","15.2.9-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.9-tuxcare.0"},{"fixed":"15.2.9-tuxcare.9"}]}],"versions":["15.2.9","15.2.9-tuxcare.1","15.2.9-tuxcare.2","15.2.9-tuxcare.3","15.2.9-tuxcare.4","15.2.9-tuxcare.5","15.2.9-tuxcare.6","15.2.9-tuxcare.7","15.2.9-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.6-tuxcare.0"},{"fixed":"15.2.6-tuxcare.9"}]}],"versions":["15.2.6","15.2.6-tuxcare.1","15.2.6-tuxcare.2","15.2.6-tuxcare.3","15.2.6-tuxcare.4","15.2.6-tuxcare.5","15.2.6-tuxcare.6","15.2.6-tuxcare.7","15.2.6-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.6-tuxcare.0"},{"fixed":"15.2.6-tuxcare.9"}]}],"versions":["15.2.6","15.2.6-tuxcare.1","15.2.6-tuxcare.2","15.2.6-tuxcare.3","15.2.6-tuxcare.4","15.2.6-tuxcare.5","15.2.6-tuxcare.6","15.2.6-tuxcare.7","15.2.6-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.6-tuxcare.0"},{"fixed":"15.2.6-tuxcare.9"}]}],"versions":["15.2.6","15.2.6-tuxcare.1","15.2.6-tuxcare.2","15.2.6-tuxcare.3","15.2.6-tuxcare.4","15.2.6-tuxcare.5","15.2.6-tuxcare.6","15.2.6-tuxcare.7","15.2.6-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.1-tuxcare.0"},{"fixed":"15.2.1-tuxcare.8"}]}],"versions":["15.2.1","15.2.1-tuxcare.1","15.2.1-tuxcare.2","15.2.1-tuxcare.3","15.2.1-tuxcare.4","15.2.1-tuxcare.5","15.2.1-tuxcare.6","15.2.1-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.1-tuxcare.0"},{"fixed":"15.2.1-tuxcare.8"}]}],"versions":["15.2.1","15.2.1-tuxcare.1","15.2.1-tuxcare.2","15.2.1-tuxcare.3","15.2.1-tuxcare.4","15.2.1-tuxcare.5","15.2.1-tuxcare.6","15.2.1-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.1-tuxcare.0"},{"fixed":"15.2.1-tuxcare.8"}]}],"versions":["15.2.1","15.2.1-tuxcare.1","15.2.1-tuxcare.2","15.2.1-tuxcare.3","15.2.1-tuxcare.4","15.2.1-tuxcare.5","15.2.1-tuxcare.6","15.2.1-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.3-tuxcare.0"},{"fixed":"15.0.3-tuxcare.10"}]}],"versions":["15.0.3","15.0.3-tuxcare.1","15.0.3-tuxcare.2","15.0.3-tuxcare.3","15.0.3-tuxcare.4","15.0.3-tuxcare.5","15.0.3-tuxcare.6","15.0.3-tuxcare.7","15.0.3-tuxcare.8","15.0.3-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.3-tuxcare.0"},{"fixed":"15.0.3-tuxcare.10"}]}],"versions":["15.0.3","15.0.3-tuxcare.1","15.0.3-tuxcare.2","15.0.3-tuxcare.3","15.0.3-tuxcare.4","15.0.3-tuxcare.5","15.0.3-tuxcare.6","15.0.3-tuxcare.7","15.0.3-tuxcare.8","15.0.3-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.3-tuxcare.0"},{"fixed":"15.0.3-tuxcare.10"}]}],"versions":["15.0.3","15.0.3-tuxcare.1","15.0.3-tuxcare.2","15.0.3-tuxcare.3","15.0.3-tuxcare.4","15.0.3-tuxcare.5","15.0.3-tuxcare.6","15.0.3-tuxcare.7","15.0.3-tuxcare.8","15.0.3-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.12-tuxcare.0"},{"fixed":"13.3.12-tuxcare.9"}]}],"versions":["13.3.12","13.3.12-tuxcare.1","13.3.12-tuxcare.2","13.3.12-tuxcare.3","13.3.12-tuxcare.4","13.3.12-tuxcare.5","13.3.12-tuxcare.6","13.3.12-tuxcare.7","13.3.12-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.12-tuxcare.0"},{"fixed":"13.3.12-tuxcare.9"}]}],"versions":["13.3.12","13.3.12-tuxcare.1","13.3.12-tuxcare.2","13.3.12-tuxcare.3","13.3.12-tuxcare.4","13.3.12-tuxcare.5","13.3.12-tuxcare.6","13.3.12-tuxcare.7","13.3.12-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.12-tuxcare.0"},{"fixed":"13.3.12-tuxcare.9"}]}],"versions":["13.3.12","13.3.12-tuxcare.1","13.3.12-tuxcare.2","13.3.12-tuxcare.3","13.3.12-tuxcare.4","13.3.12-tuxcare.5","13.3.12-tuxcare.6","13.3.12-tuxcare.7","13.3.12-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.4.0-tuxcare.0"},{"fixed":"13.4.0-tuxcare.14"}]}],"versions":["13.4.0","13.4.0-tuxcare.1","13.4.0-tuxcare.10","13.4.0-tuxcare.11","13.4.0-tuxcare.12","13.4.0-tuxcare.13","13.4.0-tuxcare.2","13.4.0-tuxcare.3","13.4.0-tuxcare.4","13.4.0-tuxcare.5","13.4.0-tuxcare.6","13.4.0-tuxcare.7","13.4.0-tuxcare.8","13.4.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.4.0-tuxcare.0"},{"fixed":"13.4.0-tuxcare.14"}]}],"versions":["13.4.0","13.4.0-tuxcare.1","13.4.0-tuxcare.10","13.4.0-tuxcare.11","13.4.0-tuxcare.12","13.4.0-tuxcare.13","13.4.0-tuxcare.2","13.4.0-tuxcare.3","13.4.0-tuxcare.4","13.4.0-tuxcare.5","13.4.0-tuxcare.6","13.4.0-tuxcare.7","13.4.0-tuxcare.8","13.4.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.4.0-tuxcare.0"},{"fixed":"13.4.0-tuxcare.14"}]}],"versions":["13.4.0","13.4.0-tuxcare.1","13.4.0-tuxcare.10","13.4.0-tuxcare.11","13.4.0-tuxcare.12","13.4.0-tuxcare.13","13.4.0-tuxcare.2","13.4.0-tuxcare.3","13.4.0-tuxcare.4","13.4.0-tuxcare.5","13.4.0-tuxcare.6","13.4.0-tuxcare.7","13.4.0-tuxcare.8","13.4.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0-tuxcare.0"},{"fixed":"13.3.0-tuxcare.9"}]}],"versions":["13.3.0","13.3.0-tuxcare.1","13.3.0-tuxcare.2","13.3.0-tuxcare.3","13.3.0-tuxcare.4","13.3.0-tuxcare.5","13.3.0-tuxcare.6","13.3.0-tuxcare.7","13.3.0-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0-tuxcare.0"},{"fixed":"13.3.0-tuxcare.9"}]}],"versions":["13.3.0","13.3.0-tuxcare.1","13.3.0-tuxcare.2","13.3.0-tuxcare.3","13.3.0-tuxcare.4","13.3.0-tuxcare.5","13.3.0-tuxcare.6","13.3.0-tuxcare.7","13.3.0-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0-tuxcare.0"},{"fixed":"13.3.0-tuxcare.9"}]}],"versions":["13.3.0","13.3.0-tuxcare.1","13.3.0-tuxcare.2","13.3.0-tuxcare.3","13.3.0-tuxcare.4","13.3.0-tuxcare.5","13.3.0-tuxcare.6","13.3.0-tuxcare.7","13.3.0-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.16"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.11","12.2.17-tuxcare.12","12.2.17-tuxcare.13","12.2.17-tuxcare.14","12.2.17-tuxcare.15","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.16"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.11","12.2.17-tuxcare.12","12.2.17-tuxcare.13","12.2.17-tuxcare.14","12.2.17-tuxcare.15","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.17-tuxcare.0"},{"fixed":"12.2.17-tuxcare.16"}]}],"versions":["12.2.17","12.2.17-tuxcare.1","12.2.17-tuxcare.10","12.2.17-tuxcare.11","12.2.17-tuxcare.12","12.2.17-tuxcare.13","12.2.17-tuxcare.14","12.2.17-tuxcare.15","12.2.17-tuxcare.2","12.2.17-tuxcare.3","12.2.17-tuxcare.4","12.2.17-tuxcare.5","12.2.17-tuxcare.6","12.2.17-tuxcare.7","12.2.17-tuxcare.8","12.2.17-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.11-tuxcare.0"},{"fixed":"13.3.11-tuxcare.8"}]}],"versions":["13.3.11","13.3.11-tuxcare.1","13.3.11-tuxcare.2","13.3.11-tuxcare.3","13.3.11-tuxcare.4","13.3.11-tuxcare.5","13.3.11-tuxcare.6","13.3.11-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.11-tuxcare.0"},{"fixed":"13.3.11-tuxcare.8"}]}],"versions":["13.3.11","13.3.11-tuxcare.1","13.3.11-tuxcare.2","13.3.11-tuxcare.3","13.3.11-tuxcare.4","13.3.11-tuxcare.5","13.3.11-tuxcare.6","13.3.11-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.11-tuxcare.0"},{"fixed":"13.3.11-tuxcare.8"}]}],"versions":["13.3.11","13.3.11-tuxcare.1","13.3.11-tuxcare.2","13.3.11-tuxcare.3","13.3.11-tuxcare.4","13.3.11-tuxcare.5","13.3.11-tuxcare.6","13.3.11-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.16-tuxcare.0"},{"fixed":"12.2.16-tuxcare.10"}]}],"versions":["12.2.16","12.2.16-tuxcare.1","12.2.16-tuxcare.2","12.2.16-tuxcare.3","12.2.16-tuxcare.4","12.2.16-tuxcare.5","12.2.16-tuxcare.6","12.2.16-tuxcare.7","12.2.16-tuxcare.8","12.2.16-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.16-tuxcare.0"},{"fixed":"12.2.16-tuxcare.10"}]}],"versions":["12.2.16","12.2.16-tuxcare.1","12.2.16-tuxcare.2","12.2.16-tuxcare.3","12.2.16-tuxcare.4","12.2.16-tuxcare.5","12.2.16-tuxcare.6","12.2.16-tuxcare.7","12.2.16-tuxcare.8","12.2.16-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.16-tuxcare.0"},{"fixed":"12.2.16-tuxcare.10"}]}],"versions":["12.2.16","12.2.16-tuxcare.1","12.2.16-tuxcare.2","12.2.16-tuxcare.3","12.2.16-tuxcare.4","12.2.16-tuxcare.5","12.2.16-tuxcare.6","12.2.16-tuxcare.7","12.2.16-tuxcare.8","12.2.16-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.12-tuxcare.0"},{"fixed":"14.2.12-tuxcare.8"}]}],"versions":["14.2.12","14.2.12-tuxcare.1","14.2.12-tuxcare.2","14.2.12-tuxcare.3","14.2.12-tuxcare.4","14.2.12-tuxcare.5","14.2.12-tuxcare.6","14.2.12-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.12-tuxcare.0"},{"fixed":"14.2.12-tuxcare.8"}]}],"versions":["14.2.12","14.2.12-tuxcare.1","14.2.12-tuxcare.2","14.2.12-tuxcare.3","14.2.12-tuxcare.4","14.2.12-tuxcare.5","14.2.12-tuxcare.6","14.2.12-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.12-tuxcare.0"},{"fixed":"14.2.12-tuxcare.8"}]}],"versions":["14.2.12","14.2.12-tuxcare.1","14.2.12-tuxcare.2","14.2.12-tuxcare.3","14.2.12-tuxcare.4","14.2.12-tuxcare.5","14.2.12-tuxcare.6","14.2.12-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-tuxcare.0"},{"fixed":"12.0.0-tuxcare.10"}]}],"versions":["12.0.0","12.0.0-tuxcare.1","12.0.0-tuxcare.2","12.0.0-tuxcare.3","12.0.0-tuxcare.4","12.0.0-tuxcare.5","12.0.0-tuxcare.6","12.0.0-tuxcare.7","12.0.0-tuxcare.8","12.0.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-tuxcare.0"},{"fixed":"12.0.0-tuxcare.10"}]}],"versions":["12.0.0","12.0.0-tuxcare.1","12.0.0-tuxcare.2","12.0.0-tuxcare.3","12.0.0-tuxcare.4","12.0.0-tuxcare.5","12.0.0-tuxcare.6","12.0.0-tuxcare.7","12.0.0-tuxcare.8","12.0.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-tuxcare.0"},{"fixed":"12.0.0-tuxcare.10"}]}],"versions":["12.0.0","12.0.0-tuxcare.1","12.0.0-tuxcare.2","12.0.0-tuxcare.3","12.0.0-tuxcare.4","12.0.0-tuxcare.5","12.0.0-tuxcare.6","12.0.0-tuxcare.7","12.0.0-tuxcare.8","12.0.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.0-tuxcare.0"},{"fixed":"12.2.0-tuxcare.10"}]}],"versions":["12.2.0","12.2.0-tuxcare.1","12.2.0-tuxcare.2","12.2.0-tuxcare.3","12.2.0-tuxcare.4","12.2.0-tuxcare.5","12.2.0-tuxcare.6","12.2.0-tuxcare.7","12.2.0-tuxcare.8","12.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.0-tuxcare.0"},{"fixed":"12.2.0-tuxcare.10"}]}],"versions":["12.2.0","12.2.0-tuxcare.1","12.2.0-tuxcare.2","12.2.0-tuxcare.3","12.2.0-tuxcare.4","12.2.0-tuxcare.5","12.2.0-tuxcare.6","12.2.0-tuxcare.7","12.2.0-tuxcare.8","12.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.0-tuxcare.0"},{"fixed":"12.2.0-tuxcare.10"}]}],"versions":["12.2.0","12.2.0-tuxcare.1","12.2.0-tuxcare.2","12.2.0-tuxcare.3","12.2.0-tuxcare.4","12.2.0-tuxcare.5","12.2.0-tuxcare.6","12.2.0-tuxcare.7","12.2.0-tuxcare.8","12.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.14-tuxcare.0"},{"fixed":"11.2.14-tuxcare.16"}]}],"versions":["11.2.14","11.2.14-tuxcare.1","11.2.14-tuxcare.10","11.2.14-tuxcare.11","11.2.14-tuxcare.12","11.2.14-tuxcare.13","11.2.14-tuxcare.14","11.2.14-tuxcare.15","11.2.14-tuxcare.2","11.2.14-tuxcare.3","11.2.14-tuxcare.4","11.2.14-tuxcare.5","11.2.14-tuxcare.6","11.2.14-tuxcare.7","11.2.14-tuxcare.8","11.2.14-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.14-tuxcare.0"},{"fixed":"11.2.14-tuxcare.16"}]}],"versions":["11.2.14","11.2.14-tuxcare.1","11.2.14-tuxcare.10","11.2.14-tuxcare.11","11.2.14-tuxcare.12","11.2.14-tuxcare.13","11.2.14-tuxcare.14","11.2.14-tuxcare.15","11.2.14-tuxcare.2","11.2.14-tuxcare.3","11.2.14-tuxcare.4","11.2.14-tuxcare.5","11.2.14-tuxcare.6","11.2.14-tuxcare.7","11.2.14-tuxcare.8","11.2.14-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.14-tuxcare.0"},{"fixed":"11.2.14-tuxcare.16"}]}],"versions":["11.2.14","11.2.14-tuxcare.1","11.2.14-tuxcare.10","11.2.14-tuxcare.11","11.2.14-tuxcare.12","11.2.14-tuxcare.13","11.2.14-tuxcare.14","11.2.14-tuxcare.15","11.2.14-tuxcare.2","11.2.14-tuxcare.3","11.2.14-tuxcare.4","11.2.14-tuxcare.5","11.2.14-tuxcare.6","11.2.14-tuxcare.7","11.2.14-tuxcare.8","11.2.14-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.3.0-tuxcare.0"},{"fixed":"14.3.0-tuxcare.15"}]}],"versions":["14.3.0","14.3.0-tuxcare.1","14.3.0-tuxcare.10","14.3.0-tuxcare.11","14.3.0-tuxcare.12","14.3.0-tuxcare.13","14.3.0-tuxcare.14","14.3.0-tuxcare.2","14.3.0-tuxcare.3","14.3.0-tuxcare.4","14.3.0-tuxcare.5","14.3.0-tuxcare.6","14.3.0-tuxcare.7","14.3.0-tuxcare.8","14.3.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.3.0-tuxcare.0"},{"fixed":"14.3.0-tuxcare.15"}]}],"versions":["14.3.0","14.3.0-tuxcare.1","14.3.0-tuxcare.10","14.3.0-tuxcare.11","14.3.0-tuxcare.12","14.3.0-tuxcare.13","14.3.0-tuxcare.14","14.3.0-tuxcare.2","14.3.0-tuxcare.3","14.3.0-tuxcare.4","14.3.0-tuxcare.5","14.3.0-tuxcare.6","14.3.0-tuxcare.7","14.3.0-tuxcare.8","14.3.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.3.0-tuxcare.0"},{"fixed":"14.3.0-tuxcare.15"}]}],"versions":["14.3.0","14.3.0-tuxcare.1","14.3.0-tuxcare.10","14.3.0-tuxcare.11","14.3.0-tuxcare.12","14.3.0-tuxcare.13","14.3.0-tuxcare.14","14.3.0-tuxcare.2","14.3.0-tuxcare.3","14.3.0-tuxcare.4","14.3.0-tuxcare.5","14.3.0-tuxcare.6","14.3.0-tuxcare.7","14.3.0-tuxcare.8","14.3.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.0-tuxcare.0"},{"fixed":"11.2.0-tuxcare.10"}]}],"versions":["11.2.0","11.2.0-tuxcare.1","11.2.0-tuxcare.2","11.2.0-tuxcare.3","11.2.0-tuxcare.4","11.2.0-tuxcare.5","11.2.0-tuxcare.6","11.2.0-tuxcare.7","11.2.0-tuxcare.8","11.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.0-tuxcare.0"},{"fixed":"11.2.0-tuxcare.10"}]}],"versions":["11.2.0","11.2.0-tuxcare.1","11.2.0-tuxcare.2","11.2.0-tuxcare.3","11.2.0-tuxcare.4","11.2.0-tuxcare.5","11.2.0-tuxcare.6","11.2.0-tuxcare.7","11.2.0-tuxcare.8","11.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.0-tuxcare.0"},{"fixed":"11.2.0-tuxcare.10"}]}],"versions":["11.2.0","11.2.0-tuxcare.1","11.2.0-tuxcare.2","11.2.0-tuxcare.3","11.2.0-tuxcare.4","11.2.0-tuxcare.5","11.2.0-tuxcare.6","11.2.0-tuxcare.7","11.2.0-tuxcare.8","11.2.0-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.8-tuxcare.0"},{"fixed":"14.2.8-tuxcare.9"}]}],"versions":["14.2.8","14.2.8-tuxcare.1","14.2.8-tuxcare.2","14.2.8-tuxcare.3","14.2.8-tuxcare.4","14.2.8-tuxcare.5","14.2.8-tuxcare.6","14.2.8-tuxcare.7","14.2.8-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.8-tuxcare.0"},{"fixed":"14.2.8-tuxcare.9"}]}],"versions":["14.2.8","14.2.8-tuxcare.1","14.2.8-tuxcare.2","14.2.8-tuxcare.3","14.2.8-tuxcare.4","14.2.8-tuxcare.5","14.2.8-tuxcare.6","14.2.8-tuxcare.7","14.2.8-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.8-tuxcare.0"},{"fixed":"14.2.8-tuxcare.9"}]}],"versions":["14.2.8","14.2.8-tuxcare.1","14.2.8-tuxcare.2","14.2.8-tuxcare.3","14.2.8-tuxcare.4","14.2.8-tuxcare.5","14.2.8-tuxcare.6","14.2.8-tuxcare.7","14.2.8-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/bazel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.11-tuxcare.0"},{"fixed":"11.2.11-tuxcare.10"}]}],"versions":["11.2.11","11.2.11-tuxcare.1","11.2.11-tuxcare.2","11.2.11-tuxcare.3","11.2.11-tuxcare.4","11.2.11-tuxcare.5","11.2.11-tuxcare.6","11.2.11-tuxcare.7","11.2.11-tuxcare.8","11.2.11-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/benchpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.11-tuxcare.0"},{"fixed":"11.2.11-tuxcare.10"}]}],"versions":["11.2.11","11.2.11-tuxcare.1","11.2.11-tuxcare.2","11.2.11-tuxcare.3","11.2.11-tuxcare.4","11.2.11-tuxcare.5","11.2.11-tuxcare.6","11.2.11-tuxcare.7","11.2.11-tuxcare.8","11.2.11-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/language-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.11-tuxcare.0"},{"fixed":"11.2.11-tuxcare.10"}]}],"versions":["11.2.11","11.2.11-tuxcare.1","11.2.11-tuxcare.2","11.2.11-tuxcare.3","11.2.11-tuxcare.4","11.2.11-tuxcare.5","11.2.11-tuxcare.6","11.2.11-tuxcare.7","11.2.11-tuxcare.8","11.2.11-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"SEMVER","events":[{"introduced":"21.0.0"},{"fixed":"21.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.3.34"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/common","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]}],"products":[{"vendor":"angular","product":"angular"}],"references":[{"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/angular/angular/issues/71294","tags":["x_refsource_MISC","report"]},{"url":"https://github.com/angular/angular/pull/65683","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular/pull/71295","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular/releases/tag/21.0.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/angular/angular/releases/tag/v20.3.34","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/angular/angular/commit/0659d11c854c9c6b886a2e925afef98d70bb005f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jfgx-762w-99vr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111753.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111753","tags":["advisory"]},{"url":"https://github.com/angular/angular","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-111753","title":"Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","status":"published","published":"2026-11-05T20:25:07.322Z","modified":"2026-11-09T22:53:02.853Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-201","CWE-359"],"updated_at":"2026-11-09T23:35:21.200784Z"}],"euvd":[{"id":"EUVD-2026-117786","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","status":"published","published":"2026-11-05T20:25:07Z","modified":"2026-11-09T22:53:02Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-10T00:18:43.414497Z"}],"ghsa":[{"id":"GHSA-jfgx-762w-99vr","title":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","description":"An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.\n\n### Technical Description\n\nTo address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\\/\\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.\n\nHowever, browsers resolve request URLs passed to `fetch()` and `XMLHttpRequest.open()` using the **WHATWG URL parser**. For `http:` and `https:` schemes, the WHATWG URL standard performs several normalizations prior to resolving the authority/origin:\n* Backslashes (`\\`) are treated as forward slashes (`/`) — e.g., `/\\evil.example/x`, `\\\\evil.example/x`, `\\/evil.example/x`, `https:\\\\evil.example/x`, `https:/\\evil.example/x`.\n* Leading and trailing C0 control characters and spaces (`\u003c= 0x20`) are stripped — e.g., `' //evil.example/x'`, `'\\0//evil.example/x'`, `'\\x1f//evil.example/x'`.\n* ASCII tab (`\\t`), newline (`\\n`), and carriage return (`\\r`) characters are removed anywhere in the input — e.g., `'/\\t/evil.example/x'`, `'/\\n/evil.example/x'`, `'htt\\tps://evil.example/x'`.\n\nBecause these URLs do not match `/^(?:https?:)?\\/\\//i`, `xsrfInterceptorFn` treats them as relative same-origin URLs and attaches the `X-XSRF-TOKEN` header, while the browser resolves and dispatches the request to the cross-origin host (`evil.example`).\n\nNote: Angular `21.0.3+` and `22.x` replaced the regular expression with a WHATWG `new URL(req.url, locationOrigin)` origin comparison in [#65683](https://github.com/angular/angular/pull/65683) and were already unaffected. However, the `20.3.x` LTS branch retained the regular expression until `20.3.34`.\n\n### Impact\n\nThe token leakage bypasses Angular's built-in XSRF protection on affected versions, allowing an attacker to capture the user's valid `X-XSRF-TOKEN` header if their server permits the request and custom header via CORS. Once obtained, the attacker can perform Cross-Site Request Forgery (CSRF) attacks against the victim user's session.\n\n### Attack Preconditions\n\n1. The victim's Angular application must have **XSRF protection enabled** (enabled by default in `HttpClient`).\n2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`, `PUT`, `DELETE`, `PATCH`) to a URL they control (such as `/\\attacker.example/api` or ` //attacker.example/api`).\n\n### Patches\n\nThe issue is resolved by parsing and comparing the request URL's origin against the application's current origin using the standard `URL` constructor (`new URL(req.url, locationOrigin)`).\n\n* `21.0.3` (and all `22.x` releases)\n* `20.3.34`\n\n### Workarounds\n\nIf you cannot immediately upgrade to a patched version:\n* Validate and normalize outgoing request URLs using `new URL(url, window.location.origin)` and verify that `parsedUrl.origin === window.location.origin` before passing dynamic URLs to mutating `HttpClient` requests.\n* Avoid passing untrusted or user-controlled URLs to `HttpClient` mutating methods.","status":"published","published":"2026-10-20T20:37:57Z","modified":"2026-10-20T20:37:58Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201","CWE-359"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-111753","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","status":"published","published":"2026-11-05T21:18:35.8Z","modified":"2026-11-09T23:17:11.57Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-201","CWE-359"],"updated_at":"2026-11-10T02:16:32.988634Z"}],"osv":[{"id":"CVE-2026-111753","title":"Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","status":"published","published":"2026-11-05T20:25:07.322Z","modified":"2026-11-11T02:31:08.512028792Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201","CWE-359"],"updated_at":"2026-11-07T03:08:00.544003Z"},{"id":"GHSA-jfgx-762w-99vr","title":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","description":"An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.\n\n### Technical Description\n\nTo address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\\/\\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.\n\nHowever, browsers resolve request URLs passed to `fetch()` and `XMLHttpRequest.open()` using the **WHATWG URL parser**. For `http:` and `https:` schemes, the WHATWG URL standard performs several normalizations prior to resolving the authority/origin:\n* Backslashes (`\\`) are treated as forward slashes (`/`) — e.g., `/\\evil.example/x`, `\\\\evil.example/x`, `\\/evil.example/x`, `https:\\\\evil.example/x`, `https:/\\evil.example/x`.\n* Leading and trailing C0 control characters and spaces (`\u003c= 0x20`) are stripped — e.g., `' //evil.example/x'`, `'\\0//evil.example/x'`, `'\\x1f//evil.example/x'`.\n* ASCII tab (`\\t`), newline (`\\n`), and carriage return (`\\r`) characters are removed anywhere in the input — e.g., `'/\\t/evil.example/x'`, `'/\\n/evil.example/x'`, `'htt\\tps://evil.example/x'`.\n\nBecause these URLs do not match `/^(?:https?:)?\\/\\//i`, `xsrfInterceptorFn` treats them as relative same-origin URLs and attaches the `X-XSRF-TOKEN` header, while the browser resolves and dispatches the request to the cross-origin host (`evil.example`).\n\nNote: Angular `21.0.3+` and `22.x` replaced the regular expression with a WHATWG `new URL(req.url, locationOrigin)` origin comparison in [#65683](https://github.com/angular/angular/pull/65683) and were already unaffected. However, the `20.3.x` LTS branch retained the regular expression until `20.3.34`.\n\n### Impact\n\nThe token leakage bypasses Angular's built-in XSRF protection on affected versions, allowing an attacker to capture the user's valid `X-XSRF-TOKEN` header if their server permits the request and custom header via CORS. Once obtained, the attacker can perform Cross-Site Request Forgery (CSRF) attacks against the victim user's session.\n\n### Attack Preconditions\n\n1. The victim's Angular application must have **XSRF protection enabled** (enabled by default in `HttpClient`).\n2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`, `PUT`, `DELETE`, `PATCH`) to a URL they control (such as `/\\attacker.example/api` or ` //attacker.example/api`).\n\n### Patches\n\nThe issue is resolved by parsing and comparing the request URL's origin against the application's current origin using the standard `URL` constructor (`new URL(req.url, locationOrigin)`).\n\n* `21.0.3` (and all `22.x` releases)\n* `20.3.34`\n\n### Workarounds\n\nIf you cannot immediately upgrade to a patched version:\n* Validate and normalize outgoing request URLs using `new URL(url, window.location.origin)` and verify that `parsedUrl.origin === window.location.origin` before passing dynamic URLs to mutating `HttpClient` requests.\n* Avoid passing untrusted or user-controlled URLs to `HttpClient` mutating methods.","status":"published","published":"2026-10-20T20:37:57Z","modified":"2026-10-20T20:45:05.952939259Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201","CWE-359"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"CLSA-2026-1793093788","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 2 @angular packages to address 3 CVEs. Fixed in 19.2.25-tuxcare.7.","status":"published","published":"2026-10-27T09:36:28Z","modified":"2026-10-27T13:30:04.773286986Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793911122","title":"TuxCare security update for @angular/language-service (4 CVEs)","description":"TuxCare rebuilt @angular/language-service to address 4 CVEs. Fixed in 19.2.14-tuxcare.8.","status":"published","published":"2026-11-05T21:38:43Z","modified":"2026-11-06T13:15:15.6754549Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793911707","title":"TuxCare security update for @angular/language-service (4 CVEs)","description":"TuxCare rebuilt @angular/language-service to address 4 CVEs. Fixed in 19.2.18-tuxcare.8.","status":"published","published":"2026-11-05T21:48:27Z","modified":"2026-11-06T13:15:18.53964347Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793917233","title":"TuxCare security update for @angular/language-service (4 CVEs)","description":"TuxCare rebuilt @angular/language-service to address 4 CVEs. Fixed in 18.2.13-tuxcare.7.","status":"published","published":"2026-11-05T23:20:34Z","modified":"2026-11-06T13:15:15.077683301Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793918325","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 18.2.12-tuxcare.11.","status":"published","published":"2026-11-05T23:38:46Z","modified":"2026-11-06T13:15:16.803884452Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793919513","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 18.1.2-tuxcare.11.","status":"published","published":"2026-11-05T23:58:34Z","modified":"2026-11-06T13:15:16.802787464Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793920447","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 17.3.12-tuxcare.21.","status":"published","published":"2026-11-06T00:14:07Z","modified":"2026-11-06T13:15:17.594757696Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793920842","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 18.2.14-tuxcare.18.","status":"published","published":"2026-11-06T00:20:42Z","modified":"2026-11-06T13:15:18.546131343Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793922812","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 17.1.0-tuxcare.10.","status":"published","published":"2026-11-06T00:53:33Z","modified":"2026-11-06T13:15:14.685193602Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793926563","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.2.10-tuxcare.18.","status":"published","published":"2026-11-06T01:56:04Z","modified":"2026-11-06T13:15:02.871505673Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793927116","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.11-tuxcare.7.","status":"published","published":"2026-11-06T02:05:16Z","modified":"2026-11-06T13:15:11.668947319Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793929486","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.7-tuxcare.8.","status":"published","published":"2026-11-06T02:44:46Z","modified":"2026-11-06T13:15:02.854918867Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793930090","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 19.2.23-tuxcare.8.","status":"published","published":"2026-11-06T02:54:50Z","modified":"2026-11-06T13:15:11.67065648Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793930638","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.2.2-tuxcare.9.","status":"published","published":"2026-11-06T03:03:58Z","modified":"2026-11-06T13:15:02.861907532Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793931669","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.12-tuxcare.18.","status":"published","published":"2026-11-06T03:21:10Z","modified":"2026-11-06T13:15:02.866643136Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793932915","title":"TuxCare security update for @angular (4 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 19.2.21-tuxcare.10.","status":"published","published":"2026-11-06T03:41:56Z","modified":"2026-11-06T13:15:11.672468631Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793933364","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.2.9-tuxcare.9.","status":"published","published":"2026-11-06T03:49:25Z","modified":"2026-11-06T13:15:02.860324503Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793934035","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.2.6-tuxcare.9.","status":"published","published":"2026-11-06T04:00:36Z","modified":"2026-11-06T13:15:11.67246089Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793934376","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.2.1-tuxcare.8.","status":"published","published":"2026-11-06T04:06:17Z","modified":"2026-11-06T13:15:11.666114242Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793971152","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 15.0.3-tuxcare.10.","status":"published","published":"2026-11-06T14:19:13Z","modified":"2026-11-06T19:00:02.357790868Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793972347","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.3.12-tuxcare.9.","status":"published","published":"2026-11-06T14:39:08Z","modified":"2026-11-06T19:00:03.383644216Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793974749","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.4.0-tuxcare.14.","status":"published","published":"2026-11-06T15:19:10Z","modified":"2026-11-06T19:00:04.331239747Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793975886","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.3.0-tuxcare.9.","status":"published","published":"2026-11-06T15:38:07Z","modified":"2026-11-06T19:00:02.367511703Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793976490","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 12.2.17-tuxcare.16.","status":"published","published":"2026-11-06T15:48:11Z","modified":"2026-11-06T19:00:05.357066334Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793976818","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.3.11-tuxcare.8.","status":"published","published":"2026-11-06T15:53:39Z","modified":"2026-11-06T19:00:05.348786674Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794057503","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 12.2.16-tuxcare.10.","status":"published","published":"2026-11-07T14:18:23Z","modified":"2026-11-07T19:00:36.59859034Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794057714","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 14.2.12-tuxcare.8.","status":"published","published":"2026-11-07T14:21:55Z","modified":"2026-11-07T19:00:35.604760917Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794058055","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 12.0.0-tuxcare.10.","status":"published","published":"2026-11-07T14:27:36Z","modified":"2026-11-07T19:00:35.610094985Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794060464","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 12.2.0-tuxcare.10.","status":"published","published":"2026-11-07T15:07:45Z","modified":"2026-11-07T19:00:36.750856137Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794061344","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 11.2.14-tuxcare.16.","status":"published","published":"2026-11-07T15:22:25Z","modified":"2026-11-07T19:00:35.599946444Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794061742","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 14.3.0-tuxcare.15.","status":"published","published":"2026-11-07T15:29:03Z","modified":"2026-11-07T19:00:35.607147915Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794062088","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 11.2.0-tuxcare.10.","status":"published","published":"2026-11-07T15:34:49Z","modified":"2026-11-07T19:00:36.653220785Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794063077","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 14.2.8-tuxcare.9.","status":"published","published":"2026-11-07T15:51:18Z","modified":"2026-11-07T19:00:37.752799416Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794066068","title":"TuxCare security update for @angular (3 CVEs)","description":"TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 11.2.11-tuxcare.10.","status":"published","published":"2026-11-07T16:41:09Z","modified":"2026-11-07T19:00:37.604251447Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}