CVE-2026-88059: Angular information leak in HttpTransferCache with hierarchical HttpClient

CVE-2026-88059 · Severity: medium · CVSS 4 · Published 2026-09-10

Angular's `HttpTransferCache` feature caches HTTP responses during server-side rendering to speed up page hydration on the client. When applications use hierarchical HTTP clients where a child client delegates to a parent, a logic flaw allows responses containing sensitive user data—authenticated by the parent interceptor—to be cached and served to other users via shared caches (CDNs, reverse proxies). This can expose private user information like profiles or personal data to unauthorized visitors.

Technologies: @angular/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-88059 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88059 being exploited in the wild.
How severe is CVE-2026-88059?
Medium severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?
@angular/common (npm) SEMVER:introduced=22.0.0,fixed=22.1.1.
Is there a fix for CVE-2026-88059?
Yes. @angular/common (npm): upgrade to 22.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88059 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88059?
Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/common (npm): upgrade to 22.1.1 or later
    npm install @angular/common@22.1.1

Technical details

The vulnerability is a cache-eligibility bypass in `@angular/common`'s `HttpTransferCache` interceptor. When a child `HttpClient` delegates to a parent via `withRequestsMadeViaParent()`, the child's `TransferCache` interceptor evaluates cache eligibility before the request reaches the parent's interceptor chain. If a child request originates unauthenticated, it is marked as cacheable by the child interceptor. When the parent's interceptor then adds authentication headers (e.g., `Authorization` header or API token) and the backend returns a sensitive response, the child `TransferCache` still stores that authenticated response in `TransferState` based on its initial pre-delegation assessment. This cached state is serialized into the SSR-rendered HTML and can be served to subsequent users if the page is cached by CDNs or reverse proxies. The attack requires SSR with hydration enabled, hierarchical client delegation, parent-level auth injection, and shared HTML caching. Patches are available in versions 20.3.28, 21.2.20, and 22.1.1.

Affected products

  • Google @angular/common >= 22.0.0, < 22.1.1; >= 21.0.0, < 21.2.20; >= 20.0.0, < 20.3.28; <= 19.2.25

Identifiers

  • CVE-2026-88059
  • GHSA-p297-fm68-3q8c

Timeline

  • 2026-08-20: disclosed: Initial publication in Angular security advisory
  • 2026-09-10: advisory: GitHub Advisory Database publication
  • 2026-09-10: patched: Patches released in versions 20.3.28, 21.2.20, and 22.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.