CVE-2026-54264: @angular/service-worker Sensitive Header Leakage on Cross-Origin Redirects
Summary
CVE-2026-54264: @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker. Affects @angular/service-worker across 4 version ranges.
< 19.2.25
>= 20.0.0-next.0, < 20.3.25
>= 21.0.0-next.0, < 21.2.17
>= 22.0.0-next.0, < 22.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/service-worker package is a crucial component of the Angular framework, enabling developers to create Progressive Web Applications (PWAs) that can work offline and load faster. It manages caching and asset fetching, enhancing user experience by allowing applications to run smoothly even in low connectivity scenarios. However, this package is susceptible to vulnerabilities that can compromise sensitive data during cross-origin requests.
Vulnerability Detail
An information disclosure vulnerability exists in the @angular/service-worker package. When the Service Worker fetches assets, it retains metadata from the original request, including sensitive headers. On cross-origin redirects, the Service Worker fails to remove these sensitive headers, violating the Fetch redirect algorithm. This flaw allows remote attackers to obtain sensitive credentials, such as Authorization tokens and session cookies, by redirecting requests to untrusted external origins. The vulnerability can be exploited if the application uses the @angular/service-worker package with credentialed requests that encounter cross-origin redirects.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/service-worker@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/service-worker@19.2.25 -
>= 20.0.0-next.0, < 20.3.2520.3.25npm install @angular/service-worker@20.3.25 -
>= 21.0.0-next.0, < 21.2.1721.2.17npm install @angular/service-worker@21.2.17 -
>= 22.0.0-next.0, < 22.0.122.0.1npm install @angular/service-worker@22.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of sensitive headers in requests that may be redirected to untrusted origins. Additionally, review your application’s architecture to minimize the risk of cross-origin redirects.
Conclusion
The @angular/service-worker package has a critical vulnerability that can lead to sensitive header leakage during cross-origin redirects. It is essential to update to the patched versions to protect your application from potential data breaches. Implementing workarounds can provide temporary relief until the update is completed.
See every vulnerability recorded for @angular/service-worker →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Sensitive headers at risk include Authorization tokens, Proxy-Authorization credentials, and session cookies.
If immediate updates are not possible, consider implementing workarounds such as avoiding sensitive headers in requests that may be redirected.
This vulnerability was discovered and reported by CodeMender from Google DeepMind.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/service-worker.
