Angular.js: Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be… (CVE-2026-54266)

The vulnerability in Angular's HttpTransferCache during SSR arises from the use of a weak 32-bit hash to cache HTTP responses. This weak hash function can produce collisions, enabling attackers to craft requests that overwrite cached responses of sensitive endpoints with attacker-controlled data. This leads to state poisoning and potential leakage of sensitive information. The issue affects @angular/common versions up to 19.2.25 and was addressed by upgrading the hashing algorithm to SHA-256 in versions 20.3.25, 21.2.17, and 22.0.1. Mitigation options include disabling transfer caching for sensitive requests or entirely.

An attacker can cause hash collisions in the HttpTransferCache, overwriting cached HTTP responses with malicious content. This can poison the application state and potentially leak sensitive information. The vulnerability does not allow denial of service but impacts confidentiality and integrity of cached data.

A fix is available in Angular versions 20.3.25, 21.2.17, and 22.0.1, which replace the weak 32-bit hash with SHA-256. Users should upgrade to one of these versions to remediate the vulnerability. Alternatively, disabling HttpTransferCache for sensitive requests or globally can serve as a workaround until upgrading.