CVE-2026-54264

Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

Published Jun 22, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Analysis

Technical impact

An information disclosure vulnerability exists in the Angular @angular/service-worker package. The Service Worker incorrectly retains request headers when a cross‑origin redirect occurs, violating the Fetch redirect algorithm. The flaw, classified under CWE‑200, CWE‑212, and CWE‑359, enables a remote attacker to obtain sensitive credentials such as Authorization tokens, Proxy‑Authorization credentials, or session cookies by initiating a cross‑origin redirect to an untrusted external origin.

Affected Systems

The vulnerability applies to Angular @angular/service-worker releases prior to 22.0.1, 21.2.17, and 20.3.25. The affected vendor is Angular, and the listed versions are the only ones known to be vulnerable.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity, but the EPSS score of <1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker triggering a cross‑origin redirect that the Service Worker does not sanitize, resulting in the forwarded sensitive headers being exposed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`>= 22.0.0-next.0 < 22.0.1`	affected	—
`>= 21.0.0-next.0 < 21.2.17`	affected	—
`>= 20.0.0-next.0 < 20.3.25`	affected	—
`<= 19.2.25`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*

No data.

Vendor Product Versions

Angular

Version	Status	Scheme	Platform
`[22.0.0-next.0,22.0.1)`	affected	semver	—
`[21.0.0-next.0,21.2.17)`	affected	semver	—
`[20.0.0-next.0,20.3.25)`	affected	semver	—
`[0,19.2.25]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade @angular/service-worker to the fixed versions (22.0.1 or newer; 21.2.17 for Angular 21; 20.3.25 for Angular 20) using npm install or npm update.
Configure the application to restrict service‑worker fetch requests to trusted origins and enforce strict CORS policies to prevent cross‑origin redirects that could expose headers.
After upgrading, delete the old service worker cache and unregister stale service workers to ensure no legacy cached data remains exposed.

Generated by OpenCVE AI on August 2, 2026 at 01:36 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-qxh6-94w6-9r5p	@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.390% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/angular/angular/commit/47d68dcb26266316647133ab6385e77fc3e5ae08
https://github.com/angular/angular/pull/69029
https://github.com/angular/angular/security/advisories/GHSA-qxh6-94w6-9r5p
https://nvd.nist.gov/vuln/detail/CVE-2026-54264
https://www.cve.org/CVERecord?id=CVE-2026-54264

History

Jul 8, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-212
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54264 https://www.cve.org/CVERecord?id=CVE-2026-54264
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` threat_severity `Moderate`

Jun 23, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 6:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Jun 22, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Title		Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
Weaknesses		CWE-200 CWE-359
References		https://github.com/angular/angular/commit/47d68dcb26266316647133ab6385e77fc3e5ae08 https://github.com/angular/angular/pull/69029 https://github.com/angular/angular/security/advisories/GHSA-qxh6-94w6-9r5p
Metrics		cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}`