AIKIDO-2026-914160
@angular/common is vulnerable to Information Disclosure
40
Medium Risk
This Affects:
@angular/commonTL;DR
The @angular/common HTTP client caches server-side rendered responses in TransferState through the transfer-cache interceptor so that hydration can reuse them on the client. When an application uses hierarchical HttpClient instances configured with withRequestsMadeViaParent() alongside server-side rendering and hydration, a child client's cache interceptor decides cache eligibility before the parent client's interceptors inject authentication credentials. Authenticated, user-specific responses are therefore cached and replayed to other sessions, exposing sensitive information across users. The fix runs root interceptors in the terminal request chain so credential-injecting interceptors execute before cache eligibility is evaluated.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses server-side rendering with hydration and configures hierarchical HttpClient instances via withRequestsMadeViaParent().
Background info
@angular/common is vulnerable to Information Disclosure in versions 0.0.1 - 20.3.27, 21.0.0 - 21.2.19 and 22.0.0 - 22.1.0.
How to fix this
Upgrade the @angular/common library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant