CVE-2026-54266: Google Angular weak hashing in HttpTransferCache cache keys

CVE-2026-54266 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular's HTTP request caching mechanism for server-side rendered applications uses a weak 32-bit hash function to cache responses during initial page load. An attacker can craft specially crafted URLs that collide with sensitive endpoints (like user profile API calls), causing the application to serve the attacker's forged response data instead of legitimate sensitive information. This can lead to XSS attacks or disclosure of sensitive user data to attackers.

Technologies: @angular/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-54266 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54266 being exploited in the wild.
How severe is CVE-2026-54266?
High severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?
@angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.
Is there a fix for CVE-2026-54266?
Yes. @angular/common (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54266 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54266?
Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/common (npm): upgrade to 22.0.1 or later
    npm install @angular/common@22.0.1

Technical details

The vulnerability exists in Angular's HttpTransferCache, which caches HTTP requests made during server-side rendering to avoid repeating them during client-side hydration. Cache keys are generated by hashing request properties (method, response type, URL, body, query parameters) using a weak 32-bit DJB2-like polynomial rolling hash. The small 32-bit keyspace allows trivial hash collision discovery. An attacker can find query parameters (e.g., q=aaCAZMMM) that hash to the same value as sensitive endpoints (e.g., /api/user/profile), causing the attacker's response to overwrite the legitimate cached response in TransferState. When the application retrieves the cached data for the sensitive endpoint, it receives the attacker-controlled response, enabling state poisoning or information leakage. The fix (patched in versions 22.0.1, 21.2.17, and 20.3.25) replaces DJB2 with a cryptographically secure SHA-256 algorithm for cache key generation.

Affected products

  • Angular @angular/common 20.0.0-next.0 through 20.3.24; 21.0.0-next.0 through 21.2.16; 22.0.0-next.0 through 22.0.0; all versions before 20.0.0

Identifiers

  • CVE-2026-54266
  • GHSA-39pv-4j6c-2g6v

Timeline

  • 2026-06-15: disclosed: Security advisory GHSA-39pv-4j6c-2g6v published
  • 2026-06-05: patched: Fix merged via PR #69153 replacing DJB2 with SHA-256
  • 2026-06-10: patched: Patched versions released: 22.0.1, 21.2.17, 20.3.25

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.