Executive brief
Angular is a popular development platform used to build web and mobile applications. A security flaw was found in its server-side rendering (SSR) component that could cause private, user-specific data to be accidentally included in public web pages. If an application uses a caching service like a CDN, one user's sensitive information (such as account details or private profile data) could be stored and then shown to other visitors, leading to a significant data leak.
Technical details
An information disclosure vulnerability exists in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility fails to inspect the 'withCredentials' flag or 'Cookie' headers of outgoing HTTP requests performed during SSR. Consequently, user-specific responses containing sensitive data may be cached in the shared TransferState payload and serialized into the HTML. If the application is behind a shared caching layer (like a CDN or reverse proxy) that does not distinguish between authenticated sessions, one user's private data can be served to subsequent users. This is fixed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Affected products
- Google Angular >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
Timeline
- 2026-03-31: other: Initial pull request submitted to address the issue
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD