AIKIDO-2026-872006

@angular/common is vulnerable to Insufficient Verification of Data Authenticity

Insufficient Verification of Data AuthenticityGHSA-jhpw-976m-542j Published 4 days ago

High Risk

This Affects:

@angular/common

0.0.1 - 20.3.26

Fixed in 20.3.27

21.0.0 - 21.2.18

Fixed in 21.2.19

22.0.0 - 22.0.1

Fixed in 22.0.2

Are you affected? Scan for Free

TL;DR

@angular/common contains a cache poisoning vulnerability in its Server-Side Rendering (SSR) HttpTransferCache. Ambiguous serialization of repeated HTTP query parameters can cause distinct requests to generate the same cache key, allowing an attacker-influenced response to be reused for a different security-sensitive request during client hydration. This may result in incorrect application state or unintended reuse of cached responses.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you are using Angular SSR with HttpTransferCache enabled and make security-sensitive HttpClient requests that use repeated query parameter keys.

Background info

@angular/common is vulnerable to Insufficient Verification of Data Authenticity in versions 0.0.1 - 20.3.26, 21.0.0 - 21.2.18 and 22.0.0 - 22.0.1.

How to fix this

Upgrade the @angular/common library to the patch version. If this is not possible, disable transfer caching for sensitive HttpClient requests (transferCache: false) or disable HttpTransferCache globally.