PT-2026-67443 · Google · Angular
CVE-2026-68945
·
Published
2026-08-03
·
Updated
2026-08-03
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 20.3.27
Angular versions prior to 21.2.19
Angular versions prior to 22.0.2
Description
HttpTransferCache caches HTTP requests during Server-Side Rendering (SSR) to enable reuse during client-side hydration. The component previously generated identical cache keys for distinct request parameters when repeated values were present because it joined these values with commas. This allows semantically different HttpClient requests to share the same transfer-cache key and reuse an incorrect backend response. This ambiguity can lead to state poisoning, where incorrect or attacker-influenced cached responses are used for subsequent application logic, or cross-request response reuse across requests with different parameters.Recommendations
Update to version 20.3.27 or later.
Update to version 21.2.19 or later.
Update to version 22.0.2 or later.
As a temporary workaround, configure
HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used by setting transferCache to false.
Alternatively, disable the HTTP transfer cache globally in the application bootstrap configuration using withNoHttpTransferCache().Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Angular