The @angular/service-worker package improperly reconstructs network requests by removing explicit client-specified safety parameters such as 'credentials: omit' and 'cache: no-store', reverting them to default values ('credentials: same-origin' and default cache). This behavior causes browsers to include active credentials on requests that should omit them, risking session leaks. It also causes private or dynamic resources to be cached by the service worker, potentially exposing sensitive data post-logout. Exploitation requires an active Angular Service Worker registration, asset group patterns matching the targeted routes, an authenticated user session, and client-side fetch calls with explicit safety parameters. The vulnerability affects versions up to and including 18.2.14 and is patched in versions 19.2.23, 20.3.22, 21.2.15, and 22.0.0-rc.2.

Applications using vulnerable versions of @angular/service-worker may unintentionally expose session credentials to endpoints that should not receive them, leading to potential session leakage. Additionally, sensitive or private resources may be cached by the service worker despite client instructions not to cache, resulting in persistent access to user data after logout. This undermines confidentiality and session integrity for affected web applications.

Patches are available in @angular/service-worker versions 19.2.23, 20.3.22, 21.2.15, and 22.0.0-rc.2 and should be applied to remediate this issue. If immediate upgrade is not feasible, developers should configure session cookies with strict flags (SameSite=Strict; Secure; HttpOnly), exclude secure or dynamic endpoints from service worker asset groups in ngsw-config.json, and programmatically clear the Angular Service Worker cache storage upon user logout to prevent stale sensitive data persistence.