CVE-2026-54266
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in Angular prior to versions 22.0.1, 21.2.17, and 20.3.25 allows an attacker to overwrite HTTP responses in the TransferState cache during Server-Side Rendering (SSR). The weak 32-bit DJB2 hash used for cache key generation enables hash collisions, causing sensitive endpoint responses to be replaced with responses from other requests.
Risk Assessment
An attacker can exploit hash collisions to replace a sensitive endpoint response (e.g., /api/user/profile) with a crafted request response, potentially leading to data disclosure or manipulation on the client side.
Recommendation
Immediately update Angular to version 22.0.1, 21.2.17, or 20.3.25, depending on your branch. The update replaces the weak hashing algorithm and prevents cache key collisions.
Other vulnerabilities in Angular
See all- CVE-2026-69151Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.
- CVE-2026-69149Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).
- CVE-2026-68945Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.
- CVE-2026-50556Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.
- CVE-2026-50555Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation dependency (domino) when serializing raw-text elements like <script>, <style>, and <iframe>. A Unicode index alignment bug causes dynamic text with astral characters (e.g., emojis) before a closing tag to be improperly escaped, allowing JavaScript injection. The flaw is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
- CVE-2026-54267Medium
A DOM Clobbering vulnerability in Angular allows an attacker to replace the SSR state container (ng-state) by injecting an HTML element with the same ID. During client hydration, Angular reads data from the fake element, potentially leading to code execution or data theft.
- CVE-2026-50557Medium
A vulnerability in Angular's @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization via namespace workarounds. An attacker can inject a malicious template with custom namespaces, leading to client-side Cross-Site Scripting (XSS).
- CVE-2026-27970Medium
An XSS vulnerability in the Angular i18n pipeline allows arbitrary JavaScript execution if an attacker compromises the translation file. Affects versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 due to unsanitized HTML in ICU messages.
- CVE-2024-21490High
This vulnerability affects angular package versions from 1.3.0 and angularjs package versions from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to catastrophic backtracking, leading to super-linear runtime. With large crafted input, this can cause a denial of service (DoS). The package is End-of-Life (EOL) and will not receive fixes.
Original NVD description (English source)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in TransferState using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters). The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, allowing attackers to find hash collisions. An attacker can easily find a query parameter string (e.g., q=aaCAZMMM for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., /api/user/profile). When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the TransferState cache. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.