AIKIDO-2026-10986
@angular/common is vulnerable to Information Disclosure
82
High Risk
This Affects:
@angular/commonTL;DR
Angular's SSR HTTP transfer cache in the @angular/common/http secondary entry point can reuse responses for requests that carry session cookies or are sent with withCredentials, even when those responses are user-specific. Under concurrent SSR hydration, one visitor can receive cached HTTP data intended for another authenticated session sharing the same URL. Before the fix, only explicit Authorization-style headers were excluded by default, leaving cookie-backed and credentialed requests cacheable. The patch excludes cookie-bearing and withCredentials requests from transfer cache by default.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/common is vulnerable to Information Disclosure in versions 21.0.0 - 21.2.14, 20.0.0 - 20.3.21 and 19.0.0 - 19.2.22.
How to fix this
Upgrade the @angular/common library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.