An information disclosure vulnerability exists in the Angular @angular/service-worker package. The Service Worker incorrectly retains request headers when a cross‑origin redirect occurs, violating the Fetch redirect algorithm. The flaw, classified under CWE‑200, CWE‑212, and CWE‑359, enables a remote attacker to obtain sensitive credentials such as Authorization tokens, Proxy‑Authorization credentials, or session cookies by initiating a cross‑origin redirect to an untrusted external origin.

The vulnerability applies to Angular @angular/service-worker releases prior to 22.0.1, 21.2.17, and 20.3.25. The affected vendor is Angular, and the listed versions are the only ones known to be vulnerable.

The CVSS score of 8.3 indicates high severity, but the EPSS score of <1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker triggering a cross‑origin redirect that the Service Worker does not sanitize, resulting in the forwarded sensitive headers being exposed.