Angular Service Worker Credential Exposure Vulnerability

Executive Summary

CVE-2026-50184 is a vulnerability in the Angular Service Worker package that occurs when the service worker intercepts network requests for matched assets and reconstructs a new Request object. During this reconstruction, explicit client-defined safety parameters such as the credentials configuration (e.g., credentials: 'omit') and HTTP cache mode (e.g., cache: 'no-store') are stripped and reverted to default browser settings (credentials: 'same-origin' and default cache).

This causes the browser to include active credentials like cookies or Authorization headers in requests where the developer explicitly intended to omit them, potentially leading to session leaks. Additionally, private or non-cacheable resources may be cached by the service worker, making private page states accessible or persistent in the client’s local cache even after logout.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying if the Angular Service Worker is intercepting requests and incorrectly reconstructing them by stripping explicit client-defined safety parameters such as credentials and cache mode.

You can monitor network requests to check if requests that should omit credentials (e.g., credentials: 'omit') are instead sent with credentials included (e.g., cookies or Authorization headers).

Suggested commands include using browser developer tools or command-line tools like curl or wget to inspect request headers and cache behavior.

• Use browser developer tools (Network tab) to inspect outgoing requests and verify if credentials are included when they should be omitted.
• Run curl commands with explicit credentials options and observe if the service worker modifies the request, for example: curl --cookie-jar /dev/null --header 'Authorization:' <URL>
• Check the service worker cache storage in the browser to see if private or non-cacheable resources are being cached unexpectedly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Angular Service Worker package to a patched version where this vulnerability is fixed.

The vulnerability is fixed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

If immediate upgrade is not possible, temporary mitigations include:

• Configure strict cookie settings to limit exposure of credentials.
• Exclude secure or sensitive endpoints from being cached by the service worker.
• Programmatically clear the service worker's cache on user logout to prevent persistence of private data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in the Angular Service Worker package can lead to unintended inclusion of credentials (such as cookies or Authorization headers) in network requests and caching of private or non-cacheable resources. Such behavior risks session leaks and persistence of sensitive user data after logout.

These issues could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict control over personal and sensitive information to prevent unauthorized access or exposure.

Specifically, accidental caching of sensitive information (e.g., medical records or bank statements) on shared computers or exposure of session credentials could violate confidentiality and data minimization principles mandated by these regulations.

Mitigations such as applying patches, enforcing strict cookie settings, excluding secure endpoints from service worker caching, and clearing caches on logout are important to maintain compliance.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unintended exposure of sensitive information. Because credentials such as cookies or Authorization headers are included in requests where they should be omitted, attackers could potentially hijack user sessions or access protected resources.

Furthermore, private or non-cacheable resources might be cached by the service worker, causing sensitive data like private page states, medical records, or bank statements to persist in the client’s local cache after logout. This could allow unauthorized access to private information, especially on shared or public computers.

Useful 0 Not Useful 0