Skip to content
Vulnerability intelligence

CVE-2025-66035: @angular/common cross-site request forgery

An incomplete fix for CVE-2025-66035 could send a security token to an attacker's domain

Angular 2025
What WebPulse reported · 1 analysis
Angular's XSRF fix read URLs differently than browsers do

An incomplete fix for CVE-2025-66035 could send a security token to an attacker's domain

October 21, 2026
View CVE-2025-66035 on the NIST National Vulnerability Database →
Related vulnerabilities
CVE-2026-88058 CVE-2025-3248 CVE-2025-8671 CVE-2025-8088 CVE-2025-68788 CVE-2025-67644 CVE-2025-66208 CVE-2025-66032