An information disclosure vulnerability exists in the @angular/service-worker package of Angular. When the Service Worker fetches assets, it retains request headers, but when a request is redirected across origins it does not strip redirect algorithm. This flaw allows a remote attacker to obtain credentials such as Authorization tokens, Proxy-Authorization credentials, or session cookies by initiating a cross‑origin redirect to an untrusted external origin.

The vulnerability applies to Angular @angular/service-worker releases prior to 22.0.1, 21.2.17 and 20.3.25. The affected vendor is Angular, and the versions listed are the only ones known to be vulnerable.

The CVSS score is 8.3, indicating a high severity. The EPSS score is 0.00226 (<1%), showing a very low probability that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker triggering a cross‑origin redirect that the Service Worker does not sanitize; the attacker can then read the forwarded sensitive headers. No additional mitigation beyond upgrading is provided by the vendor.