Is CVE-2026-50170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50170 being exploited in the wild.

How severe is CVE-2026-50170?

High severity, with a CVSS score of 3.1, published 22 June 2026.

Which products and versions are affected?

@angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-rc.2.

Is there a fix for CVE-2026-50170?

Yes. @angular/common (npm): upgrade to 22.0.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50170 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50170?

Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50170: Google Angular information disclosure in @angular/common HttpTransferCache

CVE-2026-50170 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular is a popular development platform used to build web and mobile applications. A security flaw was found in its server-side rendering (SSR) component that could cause private, user-specific data to be accidentally included in public web pages. If an application uses a caching service like a CDN, one user's sensitive information (such as account details or private profile data) could be stored and then shown to other visitors, leading to a significant data leak.

Technologies: @angular/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-50170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50170 being exploited in the wild.
How severe is CVE-2026-50170?: High severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?: @angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-rc.2.
Is there a fix for CVE-2026-50170?: Yes. @angular/common (npm): upgrade to 22.0.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50170 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50170?: Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/common (npm): upgrade to 22.0.0-rc.2 or later
```
npm install @angular/common@22.0.0-rc.2
```

Technical details

An information disclosure vulnerability exists in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility fails to inspect the 'withCredentials' flag or 'Cookie' headers of outgoing HTTP requests performed during SSR. Consequently, user-specific responses containing sensitive data may be cached in the shared TransferState payload and serialized into the HTML. If the application is behind a shared caching layer (like a CDN or reverse proxy) that does not distinguish between authenticated sessions, one user's private data can be served to subsequent users. This is fixed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Affected products

Google Angular >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14

Identifiers

CVE-2026-50170
GHSA-q6f4-qqrg-jv6x

Timeline

2026-03-31: other: Initial pull request submitted to address the issue
2026-05-28: advisory: GitHub Security Advisory published
2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.