Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M

CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

High 8.8

In plain English

A high-severity insufficient verification of data authenticity in angular from angular. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	angular.js	no fix listed	DEBIAN-CVE-2026-68945
Debian:13	angular.js	no fix listed	DEBIAN-CVE-2026-68945
Ubuntu:22.04:LTS	angular.js	no fix listed	UBUNTU-CVE-2026-68945
Ubuntu:24.04:LTS	angular.js	no fix listed	UBUNTU-CVE-2026-68945
Ubuntu:26.04:LTS	angular.js	no fix listed	UBUNTU-CVE-2026-68945
Ubuntu:26.10	angular.js	no fix listed	UBUNTU-CVE-2026-68945
npm	@angular/common	no fix listed	GHSA-jhpw-976m-542j
npm	@angular/common	22.0.2	GHSA-jhpw-976m-542j
npm	@angular/common	21.2.19	GHSA-jhpw-976m-542j
npm	@angular/common	20.3.27	GHSA-jhpw-976m-542j

Affected products (as reported)

Vendor	Product	Versions
angular	angular	< 20.3.27>= 21.0.0-next.0, < 21.2.19>= 22.0.0-next.0, < 22.0.2
@angular	common	< 20.3.27>= 21.0.0-next.0, < 21.2.19>= 22.0.0-next.0, < 22.0.2

Weakness: CWE-345 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j x_refsource_CONFIRM
https://github.com/angular/angular/pull/68571 x_refsource_MISC
https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c x_refsource_MISC
https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35 x_refsource_MISC
https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b x_refsource_MISC
https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c x_refsource_MISC