CVE-2026-68945
Awaiting Analysis Awaiting Analysis - Queue

Http Transfer Cache Key Collision in Angular

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68945
EUVD
EUVD-2026-52343

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
angular angular to 20.3.27 (exc)
angular angular to 21.2.19 (exc)
angular angular to 22.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Angular, a platform for building web applications. It involves HttpTransferCache incorrectly combining repeated request parameters, causing different requests to share the same cache key. This leads to wrong backend responses being reused for semantically distinct requests.

Detection Guidance

This vulnerability is specific to Angular applications using HttpClient with repeated request parameters. Detection requires checking Angular version and inspecting HTTP request patterns. Use commands like 'npm list @angular/core' to verify versions. Look for semantically distinct requests sharing the same cache key.

Impact Analysis

The vulnerability could cause applications to receive incorrect or outdated data from the server due to cache reuse. This may lead to incorrect application behavior, user interface glitches, or data corruption in applications relying on HttpClient for requests.

Compliance Impact

The vulnerability allows semantically distinct HttpClient requests to reuse a wrong backend response due to incorrect cache key handling. This could lead to unauthorized data exposure or incorrect data processing, potentially violating GDPR principles of data accuracy and security or HIPAA requirements for secure and accurate data handling.

Mitigation Strategies

Upgrade Angular to versions 20.3.27, 21.2.19, or 22.0.2 or later immediately. Review HttpClient usage for repeated parameters that could cause cache key collisions. Test applications thoroughly after upgrade to ensure functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart