# CVE-2026-54266: Google Angular weak hashing in HttpTransferCache cache keys

Source: https://junglewise.ai/threats/cve-2026-54266-google-angular-weak-hashing-in-httptransfercache-cache-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54266 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular's HTTP request caching mechanism for server-side rendered applications uses a weak 32-bit hash function to cache responses during initial page load. An attacker can craft specially crafted URLs that collide with sensitive endpoints (like user profile API calls), causing the application to serve the attacker's forged response data instead of legitimate sensitive information. This can lead to XSS attacks or disclosure of sensitive user data to attackers.

Technologies: [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54266 being exploited in the wild.

**How severe is CVE-2026-54266?** High severity, with a CVSS score of 3.1, published 22 June 2026.

**Which products and versions are affected?** @angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.

**Is there a fix for CVE-2026-54266?** Yes. @angular/common (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54266 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54266?** Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/common (npm): upgrade to 22.0.1 or later

  ```sh
  npm install @angular/common@22.0.1
  ```


## Technical details

The vulnerability exists in Angular's HttpTransferCache, which caches HTTP requests made during server-side rendering to avoid repeating them during client-side hydration. Cache keys are generated by hashing request properties (method, response type, URL, body, query parameters) using a weak 32-bit DJB2-like polynomial rolling hash. The small 32-bit keyspace allows trivial hash collision discovery. An attacker can find query parameters (e.g., q=aaCAZMMM) that hash to the same value as sensitive endpoints (e.g., /api/user/profile), causing the attacker's response to overwrite the legitimate cached response in TransferState. When the application retrieves the cached data for the sensitive endpoint, it receives the attacker-controlled response, enabling state poisoning or information leakage. The fix (patched in versions 22.0.1, 21.2.17, and 20.3.25) replaces DJB2 with a cryptographically secure SHA-256 algorithm for cache key generation.

## Affected products

- Angular @angular/common 20.0.0-next.0 through 20.3.24; 21.0.0-next.0 through 21.2.16; 22.0.0-next.0 through 22.0.0; all versions before 20.0.0

## Identifiers

- CVE-2026-54266
- GHSA-39pv-4j6c-2g6v

## Timeline

- 2026-06-15: disclosed: Security advisory GHSA-39pv-4j6c-2g6v published
- 2026-06-05: patched: Fix merged via PR #69153 replacing DJB2 with SHA-256
- 2026-06-10: patched: Patched versions released: 22.0.1, 21.2.17, 20.3.25

## References

- [https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v](https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v)
- [https://github.com/angular/angular/pull/69153](https://github.com/angular/angular/pull/69153)
- [https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133](https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133)
- [https://github.com/angular/angular](https://github.com/angular/angular)

## Related threats

- [Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in)
- [Angular information leak in HttpTransferCache with hierarchical HttpClient](https://junglewise.ai/threats/cve-2026-88059-angular-information-leak-in-httptransfercache-with-hierarchical)
- [Angular HttpTransferCache cache-key ambiguity in SSR](https://junglewise.ai/threats/cve-2026-68945-angular-httptransfercache-cache-key-ambiguity-in-ssr)
- [Google Angular Denial of Service in @angular/common number formatting](https://junglewise.ai/threats/cve-2026-50171-google-angular-denial-of-service-in-angular-common-number)
- [Google Angular information disclosure in @angular/common HttpTransferCache](https://junglewise.ai/threats/cve-2026-50170-google-angular-information-disclosure-in-angular-common)