CVE-2025-66035: Angular @angular/common Vulnerable to XSRF Token Leakage via Protocol-Relative URLs
Summary
CVE-2025-66035: Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client. Affects @angular/common across 3 version ranges.
< 19.2.16
>= 20.0.0-next.0, < 20.3.14
>= 21.0.0-next.0, < 21.0.1
Fixed in 19.2.16, 20.3.14 or 21.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular is a popular web application framework that allows developers to build dynamic single-page applications. The @angular/common package provides essential functionalities such as common directives, pipes, and services that are widely used in Angular applications. This package includes built-in security features, including Cross-Site Request Forgery (CSRF) protection, which is crucial for safeguarding user sessions against unauthorized actions. However, a recent vulnerability has been identified that compromises this protection under specific conditions.
Vulnerability Detail
The vulnerability arises from a flaw in Angular's HttpClient, which incorrectly handles protocol-relative URLs (URLs starting with '//'). When a request is made to such a URL, Angular treats it as a same-origin request and automatically includes the XSRF token in the 'X-XSRF-TOKEN' header. This behavior allows an attacker to capture the XSRF token by tricking the application into sending a state-changing HTTP request to a malicious domain. The unauthorized disclosure of the XSRF token can lead to arbitrary CSRF attacks against the victim user's session, effectively bypassing Angular's built-in CSRF protection.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/common@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.1619.2.16npm install @angular/common@19.2.16 -
>= 20.0.0-next.0, < 20.3.1420.3.14npm install @angular/common@20.3.14 -
>= 21.0.0-next.0, < 21.0.121.0.1npm install @angular/common@21.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers should avoid using protocol-relative URLs in HttpClient requests. Instead, all backend communication URLs should be hardcoded as relative paths (starting with a single '/') or fully qualified, trusted absolute URLs. For example, instead of using:
const url = '//attacker.com/api/data';
use:
const url = 'https://attacker.com/api/data';
Conclusion
The CVE-2025-66035 vulnerability in Angular's @angular/common package highlights the importance of proper URL handling in web applications. By understanding the implications of protocol-relative URLs and taking immediate action to update the package and implement workarounds, developers can protect their applications from potential CSRF attacks.
See every vulnerability recorded for @angular/common →
FAQ
A protocol-relative URL is a URL that omits the protocol (http or https) and starts with '//' (e.g., '//example.com').
If your application uses protocol-relative URLs and has XSRF protection enabled, it may inadvertently expose the XSRF token to attackers, allowing them to perform CSRF attacks.
You should immediately update the @angular/common package to a patched version (19.2.16, 20.3.14, or 21.0.1) and avoid using protocol-relative URLs in your application.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/common.
