Unauthorized Data Exposure in Angular's HttpTransferCache
CVE-2026-88059
4MEDIUM
What is CVE-2026-88059?
A vulnerability in Angular's @angular/common HttpTransferCache allows the caching of sensitive authenticated responses during server-side rendering (SSR) when configured improperly. Exploitation occurs when a hierarchical HttpClient setup with client hydration is in use, allowing credentials from parent-level requests to leak sensitive data through cached HTML responses. This cache could be inadvertently shared with unauthorized users via CDN or reverse proxy setups. Mitigations include careful configuration of child credential handling, filtering sensitive endpoints, and marking relevant HTML content as private.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.28 < 20.0.0, 20.3.28
angular >= 21.0.0, < 21.2.20 < 21.0.0, 21.2.20