CVE-2026-50170: @angular/common Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Summary
CVE-2026-50170: @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache. Affects @angular/common across 5 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.23
>= 20.0.0-next.0, < 20.3.22
>= 21.0.0-next.0, < 21.2.15
>= 22.0.0-next.0, < 22.0.0-rc.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @angular/common package is a core part of the Angular framework, providing essential functionalities for building web applications. It includes utilities for handling HTTP requests, among other features. However, when Server-Side Rendering (SSR) and hydration are enabled, the package can inadvertently expose sensitive user data due to improper caching mechanisms.
Vulnerability Detail
A vulnerability exists in @angular/common related to the HttpTransferCache utility, which is designed to optimize hydration by caching HTTP requests during SSR. The flaw arises because the caching mechanism does not consider the 'withCredentials' flag or the 'Cookie' header, leading to the potential caching of user-specific responses. This could allow an unauthenticated attacker to access sensitive information from other authenticated users if the SSR-rendered HTML is cached in a shared environment, such as a CDN or reverse proxy.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/common@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/common@18.2.14 -
>= 19.0.0-next.0, < 19.2.2319.2.23npm install @angular/common@19.2.23 -
>= 20.0.0-next.0, < 20.3.2220.3.22npm install @angular/common@20.3.22 -
>= 21.0.0-next.0, < 21.2.1521.2.15npm install @angular/common@21.2.15 -
>= 22.0.0-next.0, < 22.0.0-rc.222.0.0-rc.2npm install @angular/common@22.0.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not cache SSR-rendered HTML responses that include user-specific data. Implement cache-control headers to prevent shared caching of sensitive content until the package can be updated.
Conclusion
The vulnerability CVE-2026-50170 in the @angular/common package poses a significant risk of information leakage due to improper caching of credentialed requests during Server-Side Rendering. It is crucial to update to the patched versions to mitigate this risk and ensure user data remains secure.
See every vulnerability recorded for @angular/common →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Affected versions include all versions prior to the patched releases: 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you to any vulnerabilities, including this one.
If immediate updates are not possible, implement cache-control headers to prevent caching of sensitive SSR-rendered HTML responses as a temporary workaround.
Detailed information about this vulnerability can be found in the advisory database on GitHub and through the official Angular documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/common.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
