Executive brief
Angular is a popular framework used to build web and mobile applications. A security flaw in its Service Worker component could allow sensitive information, such as login tokens or session cookies, to be sent to unauthorized third-party websites. This occurs when a legitimate request is redirected to a different domain, potentially allowing an attacker to hijack user sessions or access private data.
Technical details
An information disclosure vulnerability exists in the @angular/service-worker package due to a violation of the Fetch redirect algorithm. When the Service Worker fetches assets, it preserves request metadata including sensitive headers like 'Authorization', 'Cookie', and 'Proxy-Authorization'. If a request encounters a cross-origin redirect, the Service Worker fails to strip these headers before forwarding the request to the new origin. An attacker can exploit this by triggering a redirect to an untrusted domain, thereby capturing the user's credentials or session identifiers. The issue is resolved in versions 20.3.25, 21.2.17, and 22.0.1 by explicitly removing these headers during cross-origin transitions.
Affected products
- Google Angular < 20.3.25, >= 21.0.0-next.0 < 21.2.17, >= 22.0.0-next.0 < 22.0.1
Timeline
- 2026-05-31: other: Pull request submitted to fix the issue
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD