CVE-2026-88059
Awaiting Analysis Awaiting Analysis - Queue

Angular SSR Credential Leak via HttpTransferCache

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88059
EUVD
EUVD-2026-75702

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
angular angular to 22.1.1 (exc)
angular angular to 20.3.28 (inc)
angular angular to 21.2.20 (inc)
angular angular to 22.1.1 (inc)
angular angular From 20.0.0 (inc) to 20.3.28 (exc)
angular angular From 21.0.0 (inc) to 21.2.20 (exc)
angular angular From 22.0.0 (inc) to 22.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Angular involves an information leak during Server-Side Rendering (SSR) when using hierarchical HttpClient configurations with withRequestsMadeViaParent(). The child HttpClient caches an authenticated response before parent interceptors add credentials, exposing sensitive data to unauthorized users via shared caching layers like CDNs.

Detection Guidance

Detecting this vulnerability requires checking Angular application configurations and HTTP caching behavior. Review if your app uses Server-Side Rendering (SSR) with hierarchical HttpClient and withRequestsMadeViaParent(). Inspect TransferState in ng-state script for cached authenticated responses. Check if sensitive endpoints are cached without proper authentication headers.

Impact Analysis

An attacker could access cached HTML containing another user's sensitive data if your application uses SSR with hydration, hierarchical HttpClient delegation, parent-level authentication, and shared HTML caching. This could lead to unauthorized data exposure, privacy breaches, or compliance violations.

Compliance Impact

This vulnerability could violate GDPR's data protection principles by exposing personal data to unauthorized parties and HIPAA's security requirements by leaking protected health information. Organizations using affected Angular versions may face compliance failures and regulatory penalties.

Mitigation Strategies

Upgrade Angular to versions 20.3.28, 21.2.20, or 22.1.1 or later. As temporary mitigation, attach credentials at the child level, apply explicit cache filters on child clients, or disable HTTP transfer caching for sensitive routes. Avoid combining withRequestsMadeViaParent() with withFetch().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart