# CVE-2026-111753: Angular common XSRF token leakage via URL parsing discrepancy

Source: https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-111753 · Severity: medium · CVSS 4 · Published 2026-11-05

Angular's HTTP client includes built-in XSRF (cross-site request forgery) protection to prevent attackers from hijacking user sessions. A flaw in the protection mechanism allows specially crafted URLs to bypass XSRF checks, causing Angular to leak authentication tokens to attacker-controlled domains. An attacker can exploit this to capture valid XSRF tokens and perform unauthorized actions on behalf of the victim.

Technologies: [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common). Vendors: [Angular](https://junglewise.ai/threats/vendors/angular), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-111753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111753 being exploited in the wild.

**How severe is CVE-2026-111753?** Medium severity, with a CVSS score of 4, published 5 November 2026.

**Which products and versions are affected?** Angular @Angular/Common 20.x before 20.3.34; 21.0.0 to 21.0.2; @angular/common (npm) >= 21.0.0, < 21.0.3, SEMVER:introduced=21.0.0,fixed=21.0.3.

**Is there a fix for CVE-2026-111753?** Yes. @angular/common (npm): upgrade to 21.0.3 or later. Until then: Validate and normalize outgoing request URLs using new URL(url, window.location.origin) and verify that parsedUrl.origin equals window.location.origin before passing dynamic URLs to HttpClient mutating requests. Avoid passing untrusted or user-controlled URLs to HttpClient mutating methods. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111753?** Check whether you run Angular @Angular/Common or @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/common (npm): upgrade to 21.0.3 or later

  ```sh
  npm install @angular/common@21.0.3
  ```


Validate and normalize outgoing request URLs using new URL(url, window.location.origin) and verify that parsedUrl.origin equals window.location.origin before passing dynamic URLs to HttpClient mutating requests. Avoid passing untrusted or user-controlled URLs to HttpClient mutating methods.

## Technical details

The vulnerability exists in xsrfInterceptorFn, which uses a regular expression to detect absolute URLs before attaching the X-XSRF-TOKEN header. However, the regex does not account for WHATWG URL parser normalizations: backslashes converted to forward slashes, leading/trailing control characters and spaces stripped, and embedded tab/newline/carriage return characters removed. This allows crafted URLs like /\attacker.example/api or ' //attacker.example/api to bypass the regex check while the browser resolves them to cross-origin hosts, leaking the token.

## Affected products

- Angular @angular/common 20.x before 20.3.34; 21.0.0 to 21.0.2

## Identifiers

- CVE-2026-111753
- GHSA-jfgx-762w-99vr

## Timeline

- 2026-10-20: disclosed

## Related threats

- [Angular information leak in HttpTransferCache with hierarchical HttpClient](https://junglewise.ai/threats/cve-2026-88059-angular-information-leak-in-httptransfercache-with-hierarchical)
- [Angular HttpTransferCache cache-key ambiguity in SSR](https://junglewise.ai/threats/cve-2026-68945-angular-httptransfercache-cache-key-ambiguity-in-ssr)
- [Google Angular Denial of Service in @angular/common number formatting](https://junglewise.ai/threats/cve-2026-50171-google-angular-denial-of-service-in-angular-common-number)
- [Google Angular information disclosure in @angular/common HttpTransferCache](https://junglewise.ai/threats/cve-2026-50170-google-angular-information-disclosure-in-angular-common)
- [Google Angular weak hashing in HttpTransferCache cache keys](https://junglewise.ai/threats/cve-2026-54266-google-angular-weak-hashing-in-httptransfercache-cache-keys)