CVE-2026-68945

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.

During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

Impact

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

• State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
• Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Patched Versions

• 22.0.2
• 21.2.19
• 20.3.27

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:

this.http.get('/api/resource', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 17.1.0-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 19.2.23-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.1.2-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.2.12-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.2.14-tuxcare.13.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 19.2.21-tuxcare.5.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt 2 @angular packages to address 5 CVEs. Fixed in 19.2.25-tuxcare.1.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 17.1.0-tuxcare.4.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 18.1.2-tuxcare.4.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 18.2.12-tuxcare.4.

TuxCare rebuilt @angular/animations to address 2 CVEs. Fixed in 18.2.14-tuxcare.13.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 18.1.2-tuxcare.4.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 19.2.21-tuxcare.5.

TuxCare rebuilt @angular/compiler to address 5 CVEs. Fixed in 19.2.25-tuxcare.1.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 18.2.14-tuxcare.13.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 18.2.12-tuxcare.4.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt @angular/compiler to address 4 CVEs. Fixed in 17.1.0-tuxcare.4.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 19.2.23-tuxcare.3.

TuxCare rebuilt @angular/compiler to address 3 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt @angular/common to address 3 CVEs. Fixed in 17.1.0-tuxcare.4.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 18.1.2-tuxcare.4.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 18.2.12-tuxcare.4.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 18.2.14-tuxcare.13.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 19.2.23-tuxcare.3.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 19.2.21-tuxcare.5.

TuxCare rebuilt @angular/common to address 5 CVEs. Fixed in 19.2.25-tuxcare.1.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt @angular/compiler-cli to address 2 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt @angular/compiler-cli to address 2 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt @angular/compiler-cli to address 2 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt @angular/compiler-cli to address 2 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt @angular/compiler-cli to address 2 CVEs. Fixed in 18.1.2-tuxcare.4.