CVE-2026-50169: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Summary
CVE-2026-50169: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities. Affects @angular/service-worker across 5 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.23
>= 20.0.0-next.0, < 20.3.22
>= 21.0.0-next.0, < 21.2.15
>= 22.0.0-next.0, < 22.0.0-rc.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/service-worker package is a critical component of Angular applications, enabling the implementation of service workers for caching and offline capabilities. It allows developers to enhance user experience by serving cached assets and managing network requests efficiently. However, a recent vulnerability has been identified that compromises the integrity of request-policy enforcement during request reconstruction, exposing applications to potential security risks.
Vulnerability Detail
An issue in the @angular/service-worker package allows the service worker to bypass strict client-defined request redirect policies. When intercepting network requests, the service worker reconstructs a new Request object, inadvertently stripping the redirect policy configuration. This leads to automatic following of HTTP 3xx redirects, potentially exposing sensitive data or credentials if public routes redirect to secure endpoints. The vulnerability arises when an active Angular Service Worker is present, and the application makes client-side fetch calls with strict safety parameters, allowing unintended access to session-restricted resources.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/service-worker@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/service-worker@18.2.14 -
>= 19.0.0-next.0, < 19.2.2319.2.23npm install @angular/service-worker@19.2.23 -
>= 20.0.0-next.0, < 20.3.2220.3.22npm install @angular/service-worker@20.3.22 -
>= 21.0.0-next.0, < 21.2.1521.2.15npm install @angular/service-worker@21.2.15 -
>= 22.0.0-next.0, < 22.0.0-rc.222.0.0-rc.2npm install @angular/service-worker@22.0.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds: 1. Avoid public-to-private dynamic redirection by refactoring server architecture to prevent public paths from issuing HTTP 3xx redirects to authenticated secure endpoints. 2. Apply strict flags to session cookies (SameSite=Strict; Secure; HttpOnly) and consider isolating credential-guarded resources. 3. Exclude secure endpoints from the service worker configuration by verifying your ngsw-config.json settings.
Conclusion
The CVE-2026-50169 vulnerability in the @angular/service-worker package poses a significant risk to web applications by allowing unintended access to sensitive data through policy-bypass. It is crucial for developers to update to the latest patched versions and implement recommended workarounds to mitigate potential security threats.
See every vulnerability recorded for @angular/service-worker →
FAQ
CVE-2026-50169 is a vulnerability in the @angular/service-worker package that allows for policy-bypass and credential stripping, potentially exposing sensitive data.
If your application uses the @angular/service-worker package and makes client-side fetch requests with strict policies, it may unintentionally expose sensitive data through HTTP redirects.
The patched versions of the @angular/service-worker package are 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by using the Vulert playground without any signup.
The CVSS score of this vulnerability is 5.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/service-worker.
