Read the docs
TI-2026-36933 Aliases CVE-2026-50170GHSA-q6f4-qqrg-jv6x

Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Priority LOW 36CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed angular (angular): 22.0.0-rc.2, 21.2.15, 20.3.22 +1@angular/common (npm): 22.0.0-rc.2, 20.3.22, 19.2.23 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.15; 20.0.0-next.0 to before 20.3.22; 19.0.0-next.0 to before 19.2.23; up to 18.2.1422.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23Patch availableCNA
—@angular/common (npm)22.0.0-next.0 to before 22.0.0-rc.222.0.0-rc.2Patch availableGHSA-q6f4-qqrg-jv6x
—@angular/common (npm)20.0.0-next.0 to before 20.3.2220.3.22Patch availableGHSA-q6f4-qqrg-jv6x
—@angular/common (npm)19.0.0-next.0 to before 19.2.2319.2.23Patch availableGHSA-q6f4-qqrg-jv6x
—@angular/common (npm)up to 18.2.14—No fix listedGHSA-q6f4-qqrg-jv6x
—@angular/common (npm)21.0.0-next.0 to before 21.2.1521.2.15Patch availableGHSA-q6f4-qqrg-jv6x
  • angular Vendorangular Affected 22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.15; 20.0.0-next.0 to before 20.3.22; 19.0.0-next.0 to before 19.2.23; up to 18.2.14 Fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23 Patch available CNA
  • @angular/common (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-rc.2 Fixed in 22.0.0-rc.2 Patch available GHSA-q6f4-qqrg-jv6x
  • @angular/common (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.22 Fixed in 20.3.22 Patch available GHSA-q6f4-qqrg-jv6x
  • @angular/common (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.23 Fixed in 19.2.23 Patch available GHSA-q6f4-qqrg-jv6x
  • @angular/common (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-q6f4-qqrg-jv6x
  • @angular/common (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.15 Fixed in 21.2.15 Patch available GHSA-q6f4-qqrg-jv6x

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*up to 18.2.14; 19.0.0 to before 19.2.23; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*22.0.0 next0Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*22.0.0 next1Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*22.0.0 next10Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*22.0.0 next11Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*22.0.0 next12Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*22.0.0 next2Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*22.0.0 next3Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*22.0.0 next4Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*22.0.0 next5Vulnerableangular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions up to 18.2.14; 19.0.0 to before 19.2.23; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* Versions 22.0.0 next0 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* Versions 22.0.0 next1 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* Versions 22.0.0 next10 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* Versions 22.0.0 next11 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* Versions 22.0.0 next12 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* Versions 22.0.0 next2 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* Versions 22.0.0 next3 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* Versions 22.0.0 next4 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* Versions 22.0.0 next5 Vulnerable ·angular
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*22.0.0 next6Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*22.0.0 next7Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*22.0.0 next8Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*22.0.0 next9Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:*22.0.0 rc0Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:*22.0.0 rc1Vulnerableangular
  • cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* Versions 22.0.0 next6 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* Versions 22.0.0 next7 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* Versions 22.0.0 next8 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* Versions 22.0.0 next9 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* Versions 22.0.0 rc0 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* Versions 22.0.0 rc1 Vulnerable ·angular

Remediation

  • Fix · CNA angular (angular) Fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23
  • Fix · GHSA-q6f4-qqrg-jv6x @angular/common (npm) Fixed in 22.0.0-rc.2 Advisory →
  • Fix · GHSA-q6f4-qqrg-jv6x @angular/common (npm) Fixed in 20.3.22 Advisory →
  • Fix · GHSA-q6f4-qqrg-jv6x @angular/common (npm) Fixed in 19.2.23 Advisory →
  • Fix · GHSA-q6f4-qqrg-jv6x @angular/common (npm) Fixed in 21.2.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50170
  2. 2026-10-03 Alias added: GHSA-q6f4-qqrg-jv6x

References

Patch 1

Advisory 2

Other 1

  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
  • TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences