The vulnerability in Angular's @angular/common package involves the HttpTransferCache component which caches HTTP responses during SSR using a weak 32-bit DJB2-like hash for cache keys. Due to the small hash space, attackers can generate query parameters that produce hash collisions with sensitive endpoints, causing the cached response of a sensitive endpoint (e.g., user profile) to be overwritten by attacker-controlled data. This leads to state poisoning where the client-side application consumes forged data, potentially bypassing client-side security controls or causing DOM-based XSS if rendered unsafely. Additionally, sensitive data may be leaked if the overwritten response is rendered incorrectly. The issue affects versions up to 19.2.25 and has been patched in versions 20.3.25, 21.2.17, and 22.0.1 by replacing the weak hash with a cryptographically secure SHA-256 hash for cache keys. Workarounds include disabling transfer caching on sensitive requests or globally disabling the HTTP transfer cache.

An attacker can cause the HttpTransferCache to return attacker-controlled responses for sensitive endpoints by exploiting hash collisions in the weak 32-bit cache key. This can lead to state poisoning, where the application runs with forged data, potentially bypassing client-side security controls or enabling DOM-based XSS. There is also a risk of information leakage if sensitive data is incorrectly rendered or associated with attacker-controlled responses. The vulnerability compromises the integrity and confidentiality of cached HTTP responses during SSR hydration.

A fix is available in @angular/common versions 20.3.25, 21.2.17, and 22.0.1, which replace the weak 32-bit hash with a SHA-256 based cache key. Users should upgrade to one of these patched versions. If immediate upgrade is not possible, configure HttpClient requests for sensitive endpoints to disable transfer caching by setting `transferCache: false`. Alternatively, disable the HTTP transfer cache globally using the provided Angular bootstrap configuration. These mitigations prevent the use of the vulnerable caching mechanism for sensitive data.