CVE-2026-68945: Angular HttpTransferCache cache-key ambiguity in SSR

CVE-2026-68945 · Severity: high · CVSS 4 · Published 2026-08-03

Angular's server-side rendering component contains a flaw in how it caches web requests. This can allow an attacker to trick the system into reusing a previous, potentially public response for a sensitive request, such as an authorization check. This could lead to unauthorized data access or the application operating on incorrect, attacker-influenced information.

Technologies: @angular/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-68945 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68945 being exploited in the wild.
How severe is CVE-2026-68945?
High severity, with a CVSS score of 4, published 3 August 2026.
Which products and versions are affected?
@angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.2.
Is there a fix for CVE-2026-68945?
Yes. @angular/common (npm): upgrade to 22.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68945 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68945?
Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/common (npm): upgrade to 22.0.2 or later
    npm install @angular/common@22.0.2

Technical details

A cache-key ambiguity exists in Angular's HttpTransferCache during Server-Side Rendering (SSR). The component previously serialized repeated HTTP parameters by joining them with commas (e.g., 'role=user&role=admin' and 'role=user,admin' both became 'role=user,admin'), resulting in identical cache keys for semantically different requests. An attacker can exploit this by making a request with a comma-separated scalar value that matches the serialized key of a subsequent sensitive request (like an authorization check). If the cache is hit, the application may reuse the attacker-influenced response instead of fetching fresh data from the backend. This is patched in versions 22.0.2, 21.2.19, and 20.3.27.

Affected products

  • Angular @angular/common >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25

Identifiers

  • CVE-2026-68945
  • GHSA-jhpw-976m-542j

Timeline

  • 2026-07-29: disclosed: Vulnerability published to angular/angular repository
  • 2026-08-03: advisory: GitHub Advisory GHSA-jhpw-976m-542j published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.