EUVD-2026-75702
GHSA-p297-fm68-3q8c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
AC:H for four required non-default configuration conditions; PR:N because the exploiting party is an unauthenticated visitor; C:L for partial data disclosure of a single cached endpoint response.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on @angular/common (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 22.0.0.
DescriptionCVE.org
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
AnalysisAI
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hierarchical HttpClient is misconfigured with withRequestsMadeViaParent and SSR HTML is shared via a CDN or reverse proxy. The child injector's TransferCache evaluates each request before delegating it to the parent interceptor chain, so it sees the request as anonymous and stores the private authenticated response in the ng-state script tag serialized in the rendered HTML. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four of the following non-default conditions must be simultaneously present: (1) provideClientHydration is configured for Angular SSR hydration; (2) the child HttpClient is initialized with withRequestsMadeViaParent(), delegating backend calls to a parent injector's HttpClient; (3) credentials - an Authorization header, authentication cookie, or API token - are injected by parent-level interceptors rather than child-level interceptors, causing the child TransferCache to evaluate the request as anonymous before delegation; and (4) the resulting SSR HTML is served from a shared cache - CDN, reverse proxy, or application-level cache - that does not distinguish between authenticated and unauthenticated responses for the same URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N scores 4.0, which accurately reflects the narrow but consequential nature of the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Angular 20.3.28, 21.2.20, or 22.1.1 (the appropriate patched release for the installed major/minor track), as confirmed by GitHub release tags and commit references c45028e, caf616670, and e4c416c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today