Is CVE-2026-54264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54264 being exploited in the wild.

How severe is CVE-2026-54264?

High severity, with a CVSS score of 3.1, published 22 June 2026.

Which products and versions are affected?

@angular/service-worker (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.

Is there a fix for CVE-2026-54264?

Yes. @angular/service-worker (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54264 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54264?

Check whether you run @angular/service-worker (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54264: Google Angular sensitive header leakage in Service Worker

CVE-2026-54264 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular is a popular framework used to build web and mobile applications. A security flaw in its Service Worker component could allow sensitive information, such as login tokens or session cookies, to be sent to unauthorized third-party websites. This occurs when a legitimate request is redirected to a different domain, potentially allowing an attacker to hijack user sessions or access private data.

Technologies: @angular/service-worker (npm). Vendors: npm.

Quick answers

Is CVE-2026-54264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54264 being exploited in the wild.
How severe is CVE-2026-54264?: High severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?: @angular/service-worker (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.
Is there a fix for CVE-2026-54264?: Yes. @angular/service-worker (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54264 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54264?: Check whether you run @angular/service-worker (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/service-worker (npm): upgrade to 22.0.1 or later
```
npm install @angular/service-worker@22.0.1
```

Technical details

An information disclosure vulnerability exists in the @angular/service-worker package due to a violation of the Fetch redirect algorithm. When the Service Worker fetches assets, it preserves request metadata including sensitive headers like 'Authorization', 'Cookie', and 'Proxy-Authorization'. If a request encounters a cross-origin redirect, the Service Worker fails to strip these headers before forwarding the request to the new origin. An attacker can exploit this by triggering a redirect to an untrusted domain, thereby capturing the user's credentials or session identifiers. The issue is resolved in versions 20.3.25, 21.2.17, and 22.0.1 by explicitly removing these headers during cross-origin transitions.

Affected products

Google Angular < 20.3.25, >= 21.0.0-next.0 < 21.2.17, >= 22.0.0-next.0 < 22.0.1

Identifiers

CVE-2026-54264
GHSA-qxh6-94w6-9r5p

Timeline

2026-05-31: other: Pull request submitted to fix the issue
2026-06-10: advisory: GitHub Security Advisory published
2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.