Executive brief
Angular's server-side rendering component contains a flaw in how it caches web requests. This can allow an attacker to trick the system into reusing a previous, potentially public response for a sensitive request, such as an authorization check. This could lead to unauthorized data access or the application operating on incorrect, attacker-influenced information.
Technical details
A cache-key ambiguity exists in Angular's HttpTransferCache during Server-Side Rendering (SSR). The component previously serialized repeated HTTP parameters by joining them with commas (e.g., 'role=user&role=admin' and 'role=user,admin' both became 'role=user,admin'), resulting in identical cache keys for semantically different requests. An attacker can exploit this by making a request with a comma-separated scalar value that matches the serialized key of a subsequent sensitive request (like an authorization check). If the cache is hit, the application may reuse the attacker-influenced response instead of fetching fresh data from the backend. This is patched in versions 22.0.2, 21.2.19, and 20.3.27.
Affected products
- Angular @angular/common >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25
Timeline
- 2026-07-29: disclosed: Vulnerability published to angular/angular repository
- 2026-08-03: advisory: GitHub Advisory GHSA-jhpw-976m-542j published