{"id":"CVE-2026-68945","title":"@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache (CVE-2026-68945)","summary":"A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically dif…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvssSource":"vendor","cwe":["CWE-694","CWE-345"],"vendor":"Red Hat","product":"Red Hat Ceph Storage 4","affected":["build_of_apicurio_registry 3","ceph_storage 4","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","fuse 7"],"patched":["@angular/common 22.0.2","@angular/common 21.2.19","@angular/common 20.3.27"],"published":"2026-08-03","updated":"2026-09-25","sourceUpdated":"2026-09-25T14:27:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-68945"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510710"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68945"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68945"},{"url":"https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"},{"url":"https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"},{"url":"https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"},{"url":"https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"},{"url":"https://github.com/angular/angular/pull/68571"},{"url":"https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"},{"url":"https://github.com/advisories/GHSA-jhpw-976m-542j"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00177,"epssPercentile":0.07193,"aliases":["GHSA-jhpw-976m-542j"],"ecosystem":"npm","ingestedAt":"2026-08-03T16:26:24.202Z","slug":"CVE-2026-68945","body":"## Overview\n\nA flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apicurio Registry 3, Red Hat Ceph Storage 4, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7 · no fix planned: Red Hat Ceph Storage 4, Red Hat Fuse 7, Red Hat build of Apicurio Registry 3, Red Hat Enterprise Linux 10, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json)\n\n**@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache** — rated Important by Red Hat. Released 2026-08-03, updated 2026-09-25.\n\nAffected:\n\n- Red Hat build of Apicurio Registry 3\n- Red Hat Ceph Storage 4\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Fuse 7\n\nNo fix planned:\n\n- Red Hat Ceph Storage 4\n- Red Hat Fuse 7\n- Red Hat build of Apicurio Registry 3\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat build of Apicurio Registry 3\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFix deferred\n\n## Package advisory (CVE-2026-68945)\n\nAffected packages:\n\n- `@angular/common >= 22.0.0-next.0, < 22.0.2`\n- `@angular/common >= 21.0.0-next.0, < 21.2.19`\n- `@angular/common >= 20.0.0-next.0, < 20.3.27`\n- `@angular/common <= 19.2.25`\n\nPatched in:\n\n- `@angular/common 22.0.2`\n- `@angular/common 21.2.19`\n- `@angular/common 20.3.27`\n\nSource: https://github.com/advisories/GHSA-jhpw-976m-542j","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":211322,"id":"CVE-2026-68945","ts":1790408702068,"field":"cvss","old":null,"new":"8.2"}]}