PT-2026-49561 · Google · Angular
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.0-rc.2
Angular versions prior to 21.2.15
Angular versions prior to 20.3.22
Angular versions prior to 19.2.23
Description
An issue exists in
@angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests during SSR and transferring the state to the client via TransferState. The caching mechanism does not inspect the Cookie header or the withCredentials flag of outgoing requests, causing credentialed, user-specific responses to be cached in the shared TransferState payload. When these responses are serialized into HTML, shared caching layers such as CDNs, reverse proxies, or shared server caches may store the SSR-rendered page and leak one user's private data to other users. This allows an unauthenticated attacker to obtain sensitive information of authenticated users if the application performs credentialed requests during the initial server-side render and uses a shared cache without proper cache-control headers.Recommendations
Update to version 22.0.0-rc.2
Update to version 21.2.15
Update to version 20.3.22
Update to version 19.2.23
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Angular