Vulnerability-Lookup

CVE-2026-68945 (GCVE-0-2026-68945)

Vulnerability from cvelistv5 – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58

Title

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68571	x_refsource_MISC
https://github.com/angular/angular/commit/6867f77…	x_refsource_MISC
https://github.com/angular/angular/commit/948a8d6…	x_refsource_MISC
https://github.com/angular/angular/commit/a64e288…	x_refsource_MISC
https://github.com/angular/angular/commit/a6c7fc5…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2
@angular	common	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:58:17.198889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:58:26.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        },
        {
          "product": "common",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T15:58:02.299Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
        },
        {
          "name": "https://github.com/angular/angular/pull/68571",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68571"
        },
        {
          "name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
        },
        {
          "name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
        },
        {
          "name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
        },
        {
          "name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
        }
      ],
      "source": {
        "advisory": "GHSA-jhpw-976m-542j",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68945",
    "datePublished": "2026-08-03T15:58:02.299Z",
    "dateReserved": "2026-07-31T21:49:24.928Z",
    "dateUpdated": "2026-08-03T16:58:26.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68945",
      "date": "2026-08-04",
      "epss": "0.00193",
      "percentile": "0.09267"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68945\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-03T17:16:45.033\",\"lastModified\":\"2026-08-03T17:38:23.240\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"angular\",\"product\":\"angular\",\"versions\":[{\"version\":\"\u003c 20.3.27\",\"status\":\"affected\"},{\"version\":\"\u003e= 21.0.0-next.0, \u003c 21.2.19\",\"status\":\"affected\"},{\"version\":\"\u003e= 22.0.0-next.0, \u003c 22.0.2\",\"status\":\"affected\"}]},{\"vendor\":\"@angular\",\"product\":\"common\",\"versions\":[{\"version\":\"\u003c 20.3.27\",\"status\":\"affected\"},{\"version\":\"\u003e= 21.0.0-next.0, \u003c 21.2.19\",\"status\":\"affected\"},{\"version\":\"\u003e= 22.0.0-next.0, \u003c 22.0.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-03T16:58:17.198889Z\",\"id\":\"CVE-2026-68945\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"references\":[{\"url\":\"https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/pull/68571\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T10:50:07+00:00",
      "cve": "CVE-2026-68945",
      "id": "CVE-2026-68945",
      "initial_release_date": "2026-08-03T15:58:02.299000+00:00",
      "product_status:known_affected": "80",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-345\", \"lang\": \"en\", \"description\": \"CWE-345: Insufficient Verification of Data Authenticity\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j\"}, {\"name\": \"https://github.com/angular/angular/pull/68571\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/pull/68571\"}, {\"name\": \"https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c\"}, {\"name\": \"https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35\"}, {\"name\": \"https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b\"}, {\"name\": \"https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c\"}], \"affected\": [{\"vendor\": \"angular\", \"product\": \"angular\", \"versions\": [{\"version\": \"\u003c 20.3.27\", \"status\": \"affected\"}, {\"version\": \"\u003e= 21.0.0-next.0, \u003c 21.2.19\", \"status\": \"affected\"}, {\"version\": \"\u003e= 22.0.0-next.0, \u003c 22.0.2\", \"status\": \"affected\"}]}, {\"vendor\": \"@angular\", \"product\": \"common\", \"versions\": [{\"version\": \"\u003c 20.3.27\", \"status\": \"affected\"}, {\"version\": \"\u003e= 21.0.0-next.0, \u003c 21.2.19\", \"status\": \"affected\"}, {\"version\": \"\u003e= 22.0.0-next.0, \u003c 22.0.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-03T15:58:02.299Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.\"}], \"source\": {\"advisory\": \"GHSA-jhpw-976m-542j\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-68945\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-03T16:58:17.198889Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-03T16:58:22.231Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-68945\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-07-31T21:49:24.928Z\", \"datePublished\": \"2026-08-03T15:58:02.299Z\", \"dateUpdated\": \"2026-08-03T16:58:26.263Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-JHPW-976M-542J

Vulnerability from github – Published: 2026-08-03 15:59 – Updated: 2026-08-03 15:59

Summary

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Details

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.

During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

Impact

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Patched Versions

22.0.2
21.2.19
20.3.27

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:

this.http.get('/api/resource', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0-next.0"
            },
            {
              "fixed": "22.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0-next.0"
            },
            {
              "fixed": "21.2.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0-next.0"
            },
            {
              "fixed": "20.3.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T15:59:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Angular\u0027s `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.\n\nDuring SSR, `HttpTransferCache` previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:\n\n```ts\nnew HttpParams().set(\u0027role\u0027, \u0027user,admin\u0027)\nnew HttpParams().append(\u0027role\u0027, \u0027user\u0027).append(\u0027role\u0027, \u0027admin\u0027)\n```\n\nBoth requests previously serialized as `role=user,admin`, allowing distinct `HttpClient` requests to produce the same transfer-cache key material.\n\n### Impact\n\nIn an SSR application, this cache-key ambiguity can make a later security-sensitive `HttpClient` request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular\u0027s server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:\n\n- **State Poisoning**: Using incorrect or attacker-influenced cached responses for subsequent application logic.\n- **Cross-Request Response Reuse**: Reusing cached responses across requests with semantically different parameters.\n\n### Patched Versions\n\n- 22.0.2\n- 21.2.19\n- 20.3.27\n\n### Workarounds\n\nIf you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:\n\n```ts\nthis.http.get(\u0027/api/resource\u0027, {\n  transferCache: false\n});\n```\n\nAlternatively, disable the HTTP transfer cache globally in your application bootstrap config:\n\n```ts\nimport { provideClientHydration, withNoHttpTransferCache } from \u0027@angular/platform-browser\u0027;\n\nexport const appConfig = {\n  providers: [\n    provideClientHydration(\n      withNoHttpTransferCache()\n    )\n  ]\n};\n```",
  "id": "GHSA-jhpw-976m-542j",
  "modified": "2026-08-03T15:59:13Z",
  "published": "2026-08-03T15:59:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/68571"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted