CVE-2026-68945: Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Angular’s HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.
During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:
new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')
Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.
References
- github.com/advisories/GHSA-jhpw-976m-542j
- github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
- github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
- github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
- github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
- github.com/angular/angular/pull/68571
- github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j
- nvd.nist.gov/vuln/detail/CVE-2026-68945
Code Behaviors & Features
Detect and mitigate CVE-2026-68945 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →