---
id: CVE-2026-68945
title: >-
  @angular/common: Angular: Cross-Request Response Reuse and State Poisoning in
  HttpTransferCache (CVE-2026-68945)
summary: >-
  A flaw was found in Angular's HttpTransferCache component. This component,
  used for caching HTTP requests during server-side rendering, incorrectly
  generates cache keys when repeated request parameters are present, causing
  semantically dif…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-694
  - CWE-345
vendor: Red Hat
product: Red Hat Ceph Storage 4
affected:
  - build_of_apicurio_registry 3
  - ceph_storage 4
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - fuse 7
patched:
  - '@angular/common 22.0.2'
  - '@angular/common 21.2.19'
  - '@angular/common 20.3.27'
published: '2026-08-03'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:27:12+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68945'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510710'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68945'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68945'
  - url: >-
      https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
  - url: >-
      https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
  - url: >-
      https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
  - url: >-
      https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
  - url: 'https://github.com/angular/angular/pull/68571'
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j'
  - url: 'https://github.com/advisories/GHSA-jhpw-976m-542j'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00177
epssPercentile: 0.07193
aliases:
  - GHSA-jhpw-976m-542j
ecosystem: npm
ingestedAt: '2026-08-03T16:26:24.202Z'
---

## Overview

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apicurio Registry 3, Red Hat Ceph Storage 4, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7 · no fix planned: Red Hat Ceph Storage 4, Red Hat Fuse 7, Red Hat build of Apicurio Registry 3, Red Hat Enterprise Linux 10, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68945.json)

**@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache** — rated Important by Red Hat. Released 2026-08-03, updated 2026-09-25.

Affected:

- Red Hat build of Apicurio Registry 3
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7

No fix planned:

- Red Hat Ceph Storage 4
- Red Hat Fuse 7
- Red Hat build of Apicurio Registry 3
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat build of Apicurio Registry 3
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

Fix deferred

## Package advisory (CVE-2026-68945)

Affected packages:

- `@angular/common >= 22.0.0-next.0, < 22.0.2`
- `@angular/common >= 21.0.0-next.0, < 21.2.19`
- `@angular/common >= 20.0.0-next.0, < 20.3.27`
- `@angular/common <= 19.2.25`

Patched in:

- `@angular/common 22.0.2`
- `@angular/common 21.2.19`
- `@angular/common 20.3.27`

Source: https://github.com/advisories/GHSA-jhpw-976m-542j