CVE-2026-68945: Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Angular’s HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.
During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:
new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')
Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.
References
- github.com/advisories/GHSA-jhpw-976m-542j
- github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
- github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
- github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
- github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
- github.com/angular/angular/pull/68571
- github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j
- nvd.nist.gov/vuln/detail/CVE-2026-68945
Code Behaviors & Features
Detect and mitigate CVE-2026-68945 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →