CVE-2026-88059 in Angular
Summary
by MITRE • 09/10/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability described involves a critical information disclosure flaw within the Angular framework's Server-Side Rendering (SSR) hydration mechanism, specifically affecting the HttpTransferCache feature prior to versions 20.3.28, 21.2.20, and 22.1.1. This issue arises from an improper handling of HTTP request caching when using a hierarchical HttpClient configuration that delegates requests through parent interceptors while utilizing withRequestsMadeViaParent. In this architecture, the child TransferCache evaluates an initially anonymous request before delegation occurs. Subsequently, a parent interceptor chain injects sensitive authentication credentials such as Authorization headers, cookies, or API tokens into the request context. Although the parent-level cache correctly skips caching requests that include these authenticated parameters to prevent leakage at its own level, the child layer fails to recognize that the underlying response is now protected by those injected credentials. Consequently, the child TransferCache proceeds to store the private, authenticated response in the TransferState object, which is serialized as JSON and embedded directly into the ng-state script within the HTML output sent to the client.
The operational impact of this vulnerability is severe, leading to unauthorized access to sensitive user data through cache poisoning mechanisms typical of shared infrastructure environments. Because SSR applications often rely on Content Delivery Networks (CDNs), reverse proxies, or application-level caches to serve static HTML responses efficiently across multiple users, a single authenticated request from one user can result in the caching and subsequent serving of that user's private response data to other visitors. An attacker who is unauthenticated or lacks proper authorization for specific resources can exploit this by requesting pages that trigger the vulnerable code path. When they receive the cached HTML containing the serialized ng-state script, they gain access to sensitive information such as personal details, financial records, or session tokens belonging to previous authenticated users. This scenario represents a classic case of server-side cache poisoning where shared caching layers inadvertently distribute private data due to insufficient differentiation between public and private responses based on authentication context.
From a classification perspective, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it results in the unintended disclosure of confidential data. It also relates closely to CWE-524: Use of Cache Containing Sensitive Information, highlighting the failure to apply appropriate cache control directives or logic for sensitive payloads. In terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates Data from Information Repositories and potentially contributes to Initial Access if session tokens are exfiltrated, allowing further lateral movement within an application ecosystem. The root cause lies in the architectural design where the child caching layer does not inherit or respect the authentication status determined by parent interceptors, creating a blind spot for sensitive data serialization during the hydration process.
To mitigate this vulnerability, developers must ensure they upgrade to Angular versions 20.3.28, 21.2.20, or later where these caching logic errors have been corrected. For applications unable to immediately update, several defensive configurations can be employed. One effective strategy is to attach credentials at the child HttpClient level rather than relying solely on parent interceptors for authentication injection, ensuring that the cache key includes credential context from the outset. Additionally, developers should utilize withHttpTransferCacheOptions to explicitly filter out sensitive endpoints or API calls from being cached in the TransferState. Disabling transfer caching entirely for routes containing personalized data is another robust mitigation strategy. Furthermore, applying HTTP response headers such as Cache-Control: private or no-store on pages that contain dynamic user-specific content can prevent CDNs and reverse proxies from storing these responses for shared use. These measures collectively ensure that sensitive authentication contexts are properly respected throughout the request lifecycle and hydration pipeline, preventing unauthorized data exposure.