Angular’s HttpTransferCache joins repeated query parameters with commas to construct a cache key. Because the key calculation is ambiguous, semantically distinct requests can share a cache key and an existing backend response may be reused. This leads to a state poisoning scenario where a client receives data that does not belong to the requested resource, potentially exposing confidential information or corrupting application state. The weakness is identified as CWE-345 and CWE-694.

Angular frameworks prior to version 20.3.27, 21.2.19, and 22.0.2 are vulnerable. The issue appears in the @angular/common module and impacts any Angular application that uses the HttpClient module before the specified releases.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and it is not listed in CISA KeV. The likely attack vector is an attacker who can control or manipulate request parameters sent from a browser running an Angular application; by sending crafted requests containing repeated parameters, the attacker can trigger the reuse of an unrelated backend response. The resulting impact can be confidentiality, integrity, or availability loss for the end-user or the application.