# CVE-2026-50170: Google Angular information disclosure in @angular/common HttpTransferCache

Source: https://junglewise.ai/threats/cve-2026-50170-google-angular-information-disclosure-in-angular-common  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-50170 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular is a popular development platform used to build web and mobile applications. A security flaw was found in its server-side rendering (SSR) component that could cause private, user-specific data to be accidentally included in public web pages. If an application uses a caching service like a CDN, one user's sensitive information (such as account details or private profile data) could be stored and then shown to other visitors, leading to a significant data leak.

Technologies: [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-50170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50170 being exploited in the wild.

**How severe is CVE-2026-50170?** High severity, with a CVSS score of 3.1, published 22 June 2026.

**Which products and versions are affected?** @angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-rc.2.

**Is there a fix for CVE-2026-50170?** Yes. @angular/common (npm): upgrade to 22.0.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50170 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50170?** Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/common (npm): upgrade to 22.0.0-rc.2 or later

  ```sh
  npm install @angular/common@22.0.0-rc.2
  ```


## Technical details

An information disclosure vulnerability exists in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility fails to inspect the 'withCredentials' flag or 'Cookie' headers of outgoing HTTP requests performed during SSR. Consequently, user-specific responses containing sensitive data may be cached in the shared TransferState payload and serialized into the HTML. If the application is behind a shared caching layer (like a CDN or reverse proxy) that does not distinguish between authenticated sessions, one user's private data can be served to subsequent users. This is fixed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

## Affected products

- Google Angular >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14

## Identifiers

- CVE-2026-50170
- GHSA-q6f4-qqrg-jv6x

## Timeline

- 2026-03-31: other: Initial pull request submitted to address the issue
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD

## References

- [https://github.com/angular/angular/pull/67964](https://github.com/angular/angular/pull/67964)
- [https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x)

## Related threats

- [Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in)
- [Angular information leak in HttpTransferCache with hierarchical HttpClient](https://junglewise.ai/threats/cve-2026-88059-angular-information-leak-in-httptransfercache-with-hierarchical)
- [Angular HttpTransferCache cache-key ambiguity in SSR](https://junglewise.ai/threats/cve-2026-68945-angular-httptransfercache-cache-key-ambiguity-in-ssr)
- [Google Angular Denial of Service in @angular/common number formatting](https://junglewise.ai/threats/cve-2026-50171-google-angular-denial-of-service-in-angular-common-number)
- [Google Angular weak hashing in HttpTransferCache cache keys](https://junglewise.ai/threats/cve-2026-54266-google-angular-weak-hashing-in-httptransfercache-cache-keys)