The vulnerability in @angular/service-worker involves the internal helper function used to reconstruct Request objects when intercepting network requests. This function removes the client-defined redirect policy (e.g., redirect: 'error'), causing the service worker to fall back to the browser's default 'follow' redirect behavior. Consequently, client-side fetch calls that expect strict redirect handling are bypassed, allowing the service worker to follow redirects to sensitive same-origin endpoints. This can lead to credential or session data exposure if public dynamic routes redirect to private, authenticated resources. Successful exploitation requires specific conditions including active service worker registration, asset group configuration matching the redirected route, same-origin redirect from public to private endpoints, an authenticated user session, and fetch calls with strict redirect policies. The issue affects versions up to and including 18.2.14 and is fixed in versions 19.2.23 and later.

Web applications using @angular/service-worker versions <=18.2.14 that rely on strict client-side redirect policies for security can have those policies bypassed. This allows the service worker to automatically follow HTTP 3xx redirects to authenticated same-origin private endpoints, potentially exposing cookies, credentials, or session-restricted data that should have been protected by the redirect policy. The vulnerability compromises the integrity of request-policy enforcement during request reconstruction by the service worker.

Patches addressing this vulnerability are available in @angular/service-worker versions 19.2.23, 20.3.22, 21.2.15, and 22.0.0-rc.2. Upgrading to one of these versions or later is the recommended remediation. If immediate upgrade is not feasible, developers should avoid public-to-private dynamic redirections on routes matched by service worker asset groups, apply strict cookie flags (SameSite=Strict; Secure; HttpOnly), isolate credential-guarded routes (e.g., via subdomains), and exclude secure endpoints from service worker asset group configurations in ngsw-config.json to prevent caching or interception.