Technical impact
The HttpTransferCache feature in @angular/common is intended to cache HTTP requests made during server‑side rendering and transfer the cached state to the client via TransferState. Because the caching logic does not examine the withCredentials flag or Cookie header, responses that contain user‑specific credentials can be cached by default. When those responses are included in the HTML generated for SSR, any caching layer such as a CDN, reverse‑proxy, or shared server cache may store the page and later serve it to other users, thereby leaking private data. This flaw satisfies CWE‑524, specifically an improper handling of session‑based information.
Affected Systems
Angular developers using versions of @angular/common older than 22.0.0‑rc.2, 21.2.15, 20.3.22, or 19.2.23 are impacted. The problem manifests only when Server‑Side Rendering and hydration are enabled.
Risk and Exploitability
The CVSS score of 8.2 labels the flaw as high‑severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, yet the potential for accidental data leakage remains significant. The likely attack vector involves a CDN or proxy that caches the SSR page; an attacker who can read the cached content can gain access to another user’s confidential information. Exploitation requires that the application renders SSR pages with transfer state containing credentialed responses, which is the normal operation of Angular SSR.
Github GHSA