CVE-2026-50170
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was found in Angular's @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache does not inspect the withCredentials flag or Cookie header, causing credentialed responses to be cached in TransferState. These responses are serialized into HTML and may be stored in CDN or proxy caches, leading to information disclosure between users.
Risk Assessment
The organization risks leaking sensitive user data (e.g., sessions, personal information) through shared SSR page caches. An attacker could access responses intended for other authenticated users.
Recommendation
Immediately update Angular to version 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23 depending on your branch. If updating is not possible, consider disabling SSR or hydration for sensitive applications.
Other vulnerabilities in @angular/common
See all- CVE-2026-50171Medium
A Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, also used by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter, allowing a maliciously crafted string with excessively large fraction digit values to cause an unbounded loop in the roundNumber function, leading to system overload.
- CVE-2026-54268High
In Angular (@angular/common) prior to versions 22.0.1, 21.2.17, and 20.3.25, a DoS vulnerability exists. The formatDate function and DatePipe do not limit the length of the format parameter, allowing CPU and memory exhaustion via a maliciously long format string.
Original NVD description (English source)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.