CVE-2026-68945 in Angular
Summary
by MITRE • 08/03/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Angular's HttpTransferCache component represents a critical security flaw that undermines the integrity of HTTP request handling and caching mechanisms within web applications built using this framework. This issue affects versions prior to 20.3.27, 21.2.19, and 22.0.2, where the transfer cache implementation exhibits improper parameter handling that creates opportunities for response injection and cache poisoning attacks. The root cause lies in how the system processes repeated request parameters during HTTP request serialization for caching purposes.
The technical flaw manifests when HttpClient makes requests with multiple parameters having the same name, such as ?tag=red&tag=blue&tag=green. In affected versions, Angular's HttpTransferCache performs a comma-separated join operation on these repeated parameters, transforming them into a single cache key like "tag=red,blue,green". This approach fundamentally breaks the semantic distinction between different parameter combinations that should result in unique backend responses, creating a scenario where semantically distinct requests end up sharing identical cache entries. The vulnerability directly maps to CWE-1074, which describes improper handling of repeated parameters in HTTP requests.
From an operational perspective, this vulnerability enables attackers to manipulate the caching behavior and potentially retrieve incorrect responses from the backend system. An attacker could craft malicious requests that exploit the cache key collision to access cached responses intended for different parameter combinations, effectively bypassing expected request isolation mechanisms. This issue particularly impacts applications that rely heavily on HTTP caching for performance optimization, as it compromises both the security and correctness of cached responses.
The mitigation strategy involves upgrading Angular applications to versions 20.3.27, 21.2.19, or 22.0.2, where the HttpTransferCache implementation has been corrected to properly handle repeated parameters without performing unsafe comma-joining operations. Organizations should conduct thorough testing of their application caching behavior following the upgrade to ensure no regressions in legitimate use cases. Additionally, security teams should monitor for any custom implementations that might have replicated similar flawed parameter handling logic outside of the core framework components. This vulnerability aligns with ATT&CK technique T1590 which involves reconnaissance through information gathering and can potentially be leveraged for further exploitation if not properly addressed.