Angular’s HttpTransferCache uses a weak 32‑bit hash to generate cache keys for HTTP responses during server‑side rendering. The collision‑prone hash allows an attacker to craft a query string that produces the same 32‑bit hash as a sensitive endpoint. When a victim follows a link containing the colliding parameter, the SSR process executes both the benign and the sensitive request; the cached response for the benign request overwrites the sensitive one in TransferState. This results in the victim receiving data from a different user or having the application’s state tampered with. The weakness is a weak hash function (CWE‑328) combined with key collision (CWE‑345), leading to confidentiality and integrity impacts on data exposed through the cache.

Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 are affected. The vulnerability exists in the angular:angular product for applications that perform server‑side rendering and rely on HttpTransferCache to cache HTTP responses. Updating the Angular framework to any version equal to or newer than the listed fixed releases protects affected deployments.

The CVSS score of 8.8 classifies this flaw as high severity, indicating a significant likelihood of misuse. Although EPSS data is unavailable, the absence from the CISA KEV catalog does not negate the potential for exploitation. Attackers can exploit the weakness simply by convincing a user to load a specially crafted URL that triggers a hash collision during SSR. Because the vulnerability relies on standard HTTP requests, no special privileges are required, making it a network‑level exploitation vector that can affect many users behind an SSR site. The risk to confidential user data and the integrity of client state warrants prompt remediation.