Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Angular HttpTransferCache can expose user data via hash collision

CVE-2026-54266 · published 4 months ago
Summary

When Angular renders pages on the server, it stores HTTP responses in a shared cache using a simple 32‑bit hash. An attacker can create a specially crafted request that produces the same hash as a sensitive request, causing the server to replace the protected data with the attacker’s data and potentially reveal personal information. Update Angular to version 22.0.1, 21.2.17, or 20.3.25 or later to fix the issue.

What to do
  • Update angular common to version 22.0.1.
  • Update angular common to version 21.2.17.
  • Update angular common to version 20.3.25.
  • Update angular @angular/common to version 22.0.1.
  • Update angular @angular/common to version 21.2.17.
  • Update angular @angular/common to version 20.3.25.
Affected software
Ecosystem VendorProductAffected versions
npm angular common >= 22.0.0-next.0, < 22.0.1
>= 21.0.0-next.0, < 21.2.17
>= 20.0.0-next.0, < 20.3.25
<= 19.2.25
Fix: upgrade to 22.0.1
npm angular @angular/common >= 22.0.0-next.0, < 22.0.1
>= 21.0.0-next.0, < 21.2.17
>= 20.0.0-next.0, < 20.3.25
<= 19.2.25
Fix: upgrade to 22.0.1
Debian:11 debian angular.js All versions
Debian:12 debian angular.js All versions
Debian:13 debian angular.js All versions
Debian:14 debian angular.js All versions
– angularjs angularjs <= 18.2.14
>= 19.0.0, < 19.2.23
>= 20.0.0, < 20.3.22
>= 21.0.0, < 21.2.15
22.0.0
cpe:2.3:a:angularjs:angularjs:*:*:*:*:*:*:*:*
– angular angular <= 19.2.25
>= 20.0.0, < 20.3.25
>= 21.0.0, < 21.2.17
>= 22.0.0, < 22.0.1
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
Ubuntu:Pro:16.04:LTS canonical angular.js All versions
Original advisory text
Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in TransferState using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters). The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, allowing attackers to find hash collisions. An attacker can easily find a query parameter string (e.g., q=aaCAZMMM for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., /api/user/profile). When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the TransferState cache. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-328Use of Weak Hash
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published22 Jun 2026
Updated26 Oct 2026
First seen15 Jun 2026
Sources
GHSA-39pv-4j6c-2g6v · GHSA
CVE-2026-54266 · NVD
GHSA-39pv-4j6c-2g6v · OSV
DEBIAN-CVE-2026-54266 · OSV
UBUNTU-CVE-2026-54266 · OSV
CVE-2026-54266 · OSV
Track software like this
Free during beta