Angular's @angular/service-worker was vulnerable to a request-policy bypass that caused the service worker to strip client‑supplied redirect strategies such as redirect: 'error' from reconstructed Request objects. As a result, the worker would automatically follow HTTP 3xx redirects, enabling it to act as a confused deputy that could expose user credentials or same‑origin session data when public routes redirect to sensitive endpoints. This flaw represented a confidentiality or integrity breach as defined by CWE‑200, CWE‑441 and CWE‑524.

Any Angular application using the @angular/service-worker package prior to the following releases is affected: Angular 22.0.0‑rc.2, 21.2.15, 20.3.22 and 19.2.23. Users running older versions of these packages are potentially vulnerable until the updates are applied.

The CVSS score of 5.7 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is an active web site using a service worker that enforces a strict redirect policy; an attacker can manipulate redirects to leak credentials or sensitive data. Given the lack of exploitation statistics, the risk appears moderate but should be mitigated by applying the vendor’s fix as soon as possible.