Executive brief
Angular's HTTP request caching mechanism for server-side rendered applications uses a weak 32-bit hash function to cache responses during initial page load. An attacker can craft specially crafted URLs that collide with sensitive endpoints (like user profile API calls), causing the application to serve the attacker's forged response data instead of legitimate sensitive information. This can lead to XSS attacks or disclosure of sensitive user data to attackers.
Technical details
The vulnerability exists in Angular's HttpTransferCache, which caches HTTP requests made during server-side rendering to avoid repeating them during client-side hydration. Cache keys are generated by hashing request properties (method, response type, URL, body, query parameters) using a weak 32-bit DJB2-like polynomial rolling hash. The small 32-bit keyspace allows trivial hash collision discovery. An attacker can find query parameters (e.g., q=aaCAZMMM) that hash to the same value as sensitive endpoints (e.g., /api/user/profile), causing the attacker's response to overwrite the legitimate cached response in TransferState. When the application retrieves the cached data for the sensitive endpoint, it receives the attacker-controlled response, enabling state poisoning or information leakage. The fix (patched in versions 22.0.1, 21.2.17, and 20.3.25) replaces DJB2 with a cryptographically secure SHA-256 algorithm for cache key generation.
Affected products
- Angular @angular/common 20.0.0-next.0 through 20.3.24; 21.0.0-next.0 through 21.2.16; 22.0.0-next.0 through 22.0.0; all versions before 20.0.0
Timeline
- 2026-06-15: disclosed: Security advisory GHSA-39pv-4j6c-2g6v published
- 2026-06-05: patched: Fix merged via PR #69153 replacing DJB2 with SHA-256
- 2026-06-10: patched: Patched versions released: 22.0.1, 21.2.17, 20.3.25