CVE-2026-68945

Overview

Angular is a TypeScript-based web development platform for building single-page and server-rendered applications. It provides a component-based architecture, dependency injection, and a full toolchain for building, testing, and deploying web apps.

A cache poisoning vulnerability (CVE-2026-68945) has been identified in Angular's @angular/common package, in the HttpTransferCache feature used during server-side rendering (SSR). HttpTransferCache builds its cache key by joining repeated request-parameter values with commas, so a request whose parameter carries a single value containing an embedded comma produces the same cache key as a request that repeats the parameter with each value separate. Because HttpClient and most backends treat those two request forms as semantically different, this collision lets a response cached for one request be served to a different, semantically distinct request during hydration.

This issue affects Angular applications built with server-side rendering and HttpTransferCache enabled, using @angular/common versions before 20.3.27, 21.2.19, or 22.0.2, or any version 19.2.25 and earlier.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/common
• Affected versions:
  • >= 22.0.0-next.0, < 22.0.2
  • >= 21.0.0-next.0, < 21.2.19
  • >= 20.0.0-next.0, < 20.3.27
  • <= 19.2.25
• GitHub repository: https://github.com/angular/angular
• Published packages: https://www.npmjs.com/package/@angular/common
• Package manager: npm
• Fixed in:
  • Angular NES
  • OSS fix: @angular/common 20.3.27, 21.2.19, 22.0.2; versions 19.2.25 and earlier have no upstream patch

Vulnerability Info

This High-severity vulnerability is found in the @angular/common package's HttpTransferCache, the mechanism Angular's server-side rendering uses to cache HTTP requests made during the initial server render so the client can reuse them during hydration instead of repeating the network call.

To look up a cached response, HttpTransferCache builds a key from the request's URL, method, and parameter values, comma-joining any parameter that appears more than once (see withHttpTransferCacheOptions).

That comma-joining makes the key ambiguous: a request sent as role=user,admin (one parameter with a comma-containing value) and a request sent as role=user and role=admin (the same parameter repeated) serialize to an identical cache key, even though HttpClient and most server frameworks treat them as different requests. An attacker who can influence one of these forms can cause the transfer cache to serve a response that was cached for the other, semantically distinct request, poisoning what a different caller receives during hydration.

Note: Applications that do not enable HttpTransferCache, or that call withNoHttpTransferCache(), are not affected. As an immediate mitigation ahead of upgrading, transfer caching can be disabled for specific requests known to use repeated or comma-bearing parameters.

‍

Steps To Reproduce

1. Configure an Angular SSR application with HttpTransferCache enabled and a backend endpoint that treats a repeated query parameter differently from a single comma-separated value, for example:

GET /api/data?role=user,admin
GET /api/data?role=user&role=admin

2. During the initial server render, one of the two requests above populates the transfer cache under a shared key, because HttpTransferCache comma-joins the repeated role parameter.

3. During client-side hydration, a request in the other form reads back the response cached for the first request instead of triggering its own network call, receiving a response that was generated for a different, semantically distinct request.

‍

Mitigation

Angular versions v19 and earlier reached end-of-life before this CVE's disclosure and will not receive a patch for this issue.

Users should apply one of the following mitigations:

• Upgrade to a patched release: @angular/common 20.3.27, 21.2.19, or 22.0.2.
• Migrate affected applications away from an unsupported Angular version.
• Leverage a commercial support partner like Angular NES for post-EOL security support.