@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache (CVE-2026-68945)

Overview

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat build of Apicurio Registry 3, Red Hat Ceph Storage 4, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7 · no fix planned: Red Hat Ceph Storage 4, Red Hat Fuse 7, Red Hat build of Apicurio Registry 3, Red Hat Enterprise Linux 10, … · updated 2026-09-25 · vex

@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache — rated Important by Red Hat. Released 2026-08-03, updated 2026-09-25.

Affected:

• Red Hat build of Apicurio Registry 3
• Red Hat Ceph Storage 4
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Fuse 7

No fix planned:

• Red Hat Ceph Storage 4
• Red Hat Fuse 7
• Red Hat build of Apicurio Registry 3
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Not affected:

• Red Hat Advanced Cluster Management for Kubernetes 2
• Red Hat build of Apicurio Registry 3
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Remediation

Fix deferred

Package advisory (CVE-2026-68945)

Affected packages:

• @angular/common >= 22.0.0-next.0, < 22.0.2
• @angular/common >= 21.0.0-next.0, < 21.2.19
• @angular/common >= 20.0.0-next.0, < 20.3.27
• @angular/common <= 19.2.25

Patched in:

• @angular/common 22.0.2
• @angular/common 21.2.19
• @angular/common 20.3.27

Source: https://github.com/advisories/GHSA-jhpw-976m-542j