CVE-2026-68945

Analyzed Analyzed - Analysis Complete

Http Transfer Cache Key Collision in Angular

Publication date: 2026-08-03

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-11

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-68945

EUVD

EUVD-2026-52343

Affected Vendors & Products

Vendor	Product	Version / Range
angular	angular	to 19.2.25 (inc)
angular	angular	From 20.0.0 (inc) to 20.3.27 (exc)
angular	angular	From 21.0.0 (inc) to 21.2.19 (exc)
angular	angular	From 22.0.0 (inc) to 22.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Angular, a platform for building web applications. It involves HttpTransferCache incorrectly combining repeated request parameters, causing different requests to share the same cache key. This leads to wrong backend responses being reused for semantically distinct requests.

Detection Guidance

This vulnerability is specific to Angular applications using HttpClient with repeated request parameters. Detection requires checking Angular version and inspecting HTTP request patterns. Use commands like 'npm list @angular/core' to verify versions. Look for semantically distinct requests sharing the same cache key.

Impact Analysis

The vulnerability could cause applications to receive incorrect or outdated data from the server due to cache reuse. This may lead to incorrect application behavior, user interface glitches, or data corruption in applications relying on HttpClient for requests.

Compliance Impact

The vulnerability allows semantically distinct HttpClient requests to reuse a wrong backend response due to incorrect cache key handling. This could lead to unauthorized data exposure or incorrect data processing, potentially violating GDPR principles of data accuracy and security or HIPAA requirements for secure and accurate data handling.

Mitigation Strategies

Upgrade Angular to versions 20.3.27, 21.2.19, or 22.0.2 or later immediately. Review HttpClient usage for repeated parameters that could cause cache key collisions. Test applications thoroughly after upgrade to ensure functionality.

Hi! I’m here to help you understand CVE-2026-68945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70