Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-03T15:58:02 @angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CWE-694

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.

Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-rhel9 Red Hat build of Apicurio Registry 3 Affected apicurio/apicurio-registry-ui-rhel8 Red Hat Ceph Storage 4 Affected ceph Red Hat Enterprise Linux 10 Affected ceph Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Not affected gjs Red Hat Enterprise Linux 10 Affected intel-cmt-cat Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected intel-cmt-cat Red Hat Enterprise Linux 8 Not affected mozjs60 Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected ceph Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Not affected gjs Red Hat Enterprise Linux 9 Affected intel-cmt-cat Red Hat Enterprise Linux 9 Affected thunderbird https://www.cve.org/CVERecord?id=CVE-2026-68945 https://nvd.nist.gov/vuln/detail/CVE-2026-68945 https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35 https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c https://github.com/angular/angular/pull/68571 https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j