Executive brief
Angular's `HttpTransferCache` feature caches HTTP responses during server-side rendering to speed up page hydration on the client. When applications use hierarchical HTTP clients where a child client delegates to a parent, a logic flaw allows responses containing sensitive user data—authenticated by the parent interceptor—to be cached and served to other users via shared caches (CDNs, reverse proxies). This can expose private user information like profiles or personal data to unauthorized visitors.
Technical details
The vulnerability is a cache-eligibility bypass in `@angular/common`'s `HttpTransferCache` interceptor. When a child `HttpClient` delegates to a parent via `withRequestsMadeViaParent()`, the child's `TransferCache` interceptor evaluates cache eligibility before the request reaches the parent's interceptor chain. If a child request originates unauthenticated, it is marked as cacheable by the child interceptor. When the parent's interceptor then adds authentication headers (e.g., `Authorization` header or API token) and the backend returns a sensitive response, the child `TransferCache` still stores that authenticated response in `TransferState` based on its initial pre-delegation assessment. This cached state is serialized into the SSR-rendered HTML and can be served to subsequent users if the page is cached by CDNs or reverse proxies. The attack requires SSR with hydration enabled, hierarchical client delegation, parent-level auth injection, and shared HTML caching. Patches are available in versions 20.3.28, 21.2.20, and 22.1.1.
Affected products
- Google @angular/common >= 22.0.0, < 22.1.1; >= 21.0.0, < 21.2.20; >= 20.0.0, < 20.3.28; <= 19.2.25
Timeline
- 2026-08-20: disclosed: Initial publication in Angular security advisory
- 2026-09-10: advisory: GitHub Advisory Database publication
- 2026-09-10: patched: Patches released in versions 20.3.28, 21.2.20, and 22.1.1