CVE-2026-54266: @angular/common Weak Cache Key Hashing Leading to Cross-Request Data Leakage
Summary
CVE-2026-54266: Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. Affects @angular/common across 4 version ranges.
< 19.2.25
>= 20.0.0-next.0, < 20.3.25
>= 21.0.0-next.0, < 21.2.17
>= 22.0.0-next.0, < 22.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/common package is a core part of the Angular framework, providing essential functionalities for building web applications. It includes features for handling HTTP requests, among others. This package is widely used in Angular applications to manage server-side rendering (SSR) and client-side hydration, making it crucial for performance and user experience. However, a vulnerability has been identified in its HttpTransferCache component, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from the use of a weak 32-bit DJB2-like polynomial rolling hash for generating cache keys in the HttpTransferCache. This small hash space allows attackers to find collisions easily. By crafting specific query parameters, an attacker can cause a sensitive endpoint's response to be overwritten by a non-sensitive response. This results in state poisoning, where the application operates with forged data, potentially leading to bypassing security controls or exposing sensitive user information.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/common@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/common@19.2.25 -
>= 20.0.0-next.0, < 20.3.2520.3.25npm install @angular/common@20.3.25 -
>= 21.0.0-next.0, < 21.2.1721.2.17npm install @angular/common@21.2.17 -
>= 22.0.0-next.0, < 22.0.122.0.1npm install @angular/common@22.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, you can configure your HttpClient requests to skip transfer caching for sensitive endpoints. Use the following code snippet:
this.http.get('/api/user/profile', {
transferCache: false
});
Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:
import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';
export const appConfig = {
providers: [ provideClientHydration( withNoHttpTransferCache()
)
]
};
Conclusion
The vulnerability CVE-2026-54266 in the @angular/common package poses significant risks to applications using this package. It is crucial to update to the patched versions or implement workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @angular/common →
FAQ
CVE-2026-54266 is a vulnerability in the @angular/common package that allows for cross-request data leakage due to weak cache key hashing.
It can lead to state poisoning and information leakage, where sensitive data may be exposed to attackers.
Versions prior to 22.0.1, 21.2.17, and 20.3.25 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground without signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/common.
