CVE-2025-68121 @angular/build@20 uses a vulnerable version of "esbuild" - "0.25.9"

[lukasmatta]

Security scanners are reporting prebuilt esbuild binaries for versions < 0.27.3 as vulnerable. For example:

https://secure.software/npm/packages/@esbuild/linux-x64/vulnerabilities/0.25.9

@angular/build@20 depends on esbuild@0.25.9.

[json-derulo]

I am questioning whether this vulnerability actually exists. esbuild uses GitHub advisories, and there is currently no published advisory that affects v0.25.9. When checking the reported vulnerabilities in more detail, they all seem to affect the Go programming language and not esbuild.

So I guess that this website has faulty data, for whatever reason.

Note that similar websites like Snyk don't report any vulnerabilities.

[lukasmatta]

I'm not sure either. When questioned about the CVE, the esbuild maintainer clarified that the issue does not apply to newer versions of esbuild, but did not dismiss it for previous versions, as noted here: evanw/esbuild#4410 (comment).

Either way, security scanner flagging is causing friction for us. As a hotfix solution for our project, I added an override with pin to 0.27.3.

[json-derulo]

I stand corrected, actually esbuild bundles Go and uses it on runtime. So the secure.software website is correct about that vulnerability report.