Packages / @angular/common / Security

HighVulnerabilityGHSA-q6f4-qqrg-jv6xCVE-2026-50170Published 15 Jun 2026

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Affected releases · @angular/common

  • 21.x21.0.0 – 21.2.14Fixed in 21.2.15
  • 20.x20.0.0 – 20.3.21Fixed in 20.3.22
  • 19.x19.0.0 – 19.2.22Fixed in 19.2.23
  • 18.x and older2.0.0 – 18.2.14No fix, no longer updated

On 21.x, the newest line:

npm install @angular/common@21.2.15
22.x

  1. Not affected

    22.0.0 – 22.2.3

    22 releases, latest

21.x

  1. Affected

    21.0.0 – 21.2.14

    32 releases

  2. Fixed

    21.2.15 – 21.2.25

    11 releases

20.x

  1. Affected

    20.0.0 – 20.3.21

    43 releases

  2. Fixed

    20.3.22 – 20.3.34

    13 releases

19.x

  1. Affected

    19.0.0 – 19.2.22

    40 releases

  2. Fixed

    19.2.23 – 19.2.25

    3 releases

18.x

  1. Affected

    18.0.0 – 18.2.14

    29 releases

17.x

  1. Affected

    17.0.0 – 17.3.12

    32 releases

16.x

  1. Affected

    16.0.0 – 16.2.12

    30 releases

15.x

  1. Affected

    15.0.0 – 15.2.10

    22 releases

14.x

  1. Affected

    14.0.0 – 14.3.0

    26 releases

13.x

  1. Affected

    13.0.0 – 13.4.0

    30 releases

12.x

  1. Affected

    12.0.0 – 12.2.17

    30 releases

11.x

  1. Affected

    11.0.0 – 11.2.14

    28 releases

10.x

  1. Affected

    10.0.0 – 10.2.5

    28 releases

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/common, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/common. It is read in your browser and sent nowhere.

What happens

A vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState.

However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability.

Impact

Successful exploitation allows an unauthenticated attacker to obtain sensitive, user-specific information of other authenticated users. This occurs when:

  • The SSR-rendered HTML containing the cached private data is stored in a shared cache (e.g., CDN, reverse proxy).

  • Subsequent requests for the same page receive the cached HTML containing the first user's private data.

Attack Preconditions

  • SSR and Hydration Enabled: The Angular application must be configured to use Server-Side Rendering and hydration (e.g., using provideClientHydration()).

  • Credentialed Requests during SSR: The application must perform HTTP requests that require user-specific authentication (using cookies or withCredentials: true) during the initial server-side render.

  • Shared Caching: The application's HTML responses must be cached by a shared caching layer (CDN, reverse proxy, or server-side cache) without proper cache-control headers to distinguish authenticated users.

Patches

  • 22.0.0-rc.2

  • 21.2.15

  • 20.3.22

  • 19.2.23