XSRF Vulnerability in Angular HttpClient Affects Request Security
CVE-2026-111753
5.9MEDIUM
What is CVE-2026-111753?
A vulnerability in the Angular framework's HttpClient allows for potential cross-site request forgery due to improper normalization of request URLs. The affected @angular/common xsrfInterceptorFn function failed to handle certain URL formats, allowing attackers to trick the system into misclassifying requests. As a result, sensitive X-XSRF-TOKEN headers might be sent to an attacker's controlled URL, thus compromising user sessions. This vulnerability is addressed in Angular versions 20.3.34 and 21.0.3.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.34 < 20.0.0, 20.3.34
angular >= 21.0.0, < 21.0.3 < 21.0.0, 21.0.3