Listen to this Post
How the Mentioned CVEs Work
Angular’s `HttpTransferCache` is designed to optimize performance in Server-Side Rendering (SSR) applications by caching HTTP responses during the server render and reusing them on the client during hydration, avoiding duplicate network requests. However, two distinct but related vulnerabilities have been identified in how these cache keys are generated.
The first vulnerability, CVE-2026-68945, arises from how the cache key handles repeated query parameters. When constructing the cache key, the `HttpTransferCache` joins repeated parameter values with commas. This creates a collision: `new HttpParams().set(‘role’, ‘user,admin’)` and `new HttpParams().append(‘role’, ‘user’).append(‘role’, ‘admin’)` both serialize to the same `role=user,admin` string. As a result, two semantically distinct HTTP requests could produce identical cache keys, causing the application to reuse a response from a different request. For example, an attacker-influenced scalar-comma request could be cached and then replayed as the response for a trusted repeated-param authorization request.
The second vulnerability, CVE-2026-54266, is related to the hashing algorithm used to generate these cache keys. Prior to the patched versions, the `TransferState` cache keys were generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, making it feasible for an attacker to find hash collisions. An attacker can craft a query parameter string that produces the exact same 32-bit hash as a sensitive endpoint (e.g., /api/user/profile). When a victim visits a crafted link, the SSR process executes both requests, and due to the hash collision, one response can overwrite the other in the `TransferState` cache.
Both issues can lead to State Poisoning, where incorrect or attacker-influenced cached responses are used in subsequent application logic, and Cross-Request Response Reuse, where responses are incorrectly shared across semantically different requests. These vulnerabilities are fixed in Angular versions 20.3.27, 21.2.19, and 22.0.2 for CVE-2026-68945, and 20.3.25, 21.2.17, and 22.0.1 for CVE-2026-54266.
DailyCVE Form:
Platform: Angular
Version: <20.3.27, <21.2.19, <22.0.2
Vulnerability: Cache-Key Ambiguity
Severity: Critical
Date: 2026-08-03
Prediction: 2026-08-10
What Undercode Say:
Check Angular version in your project ng version Check for @angular/common version in package.json cat package.json | grep @angular/common Identify if your application uses SSR grep -r "provideClientHydration" src/ grep -r "withNoHttpTransferCache" src/
Analytics: An attacker could exploit CVE-2026-68945 by sending a request with a comma-separated parameter that matches the cache key of a different, sensitive request. For CVE-2026-54266, an attacker could craft a malicious URL with query parameters that produce a hash collision with a targeted endpoint.
Exploit:
For CVE-2026-68945 (Cache-Key Ambiguity):
- Identify an endpoint that uses repeated parameters (e.g.,
/api/data?role=user&role=admin). - Craft a request that uses a comma-separated list to mimic the same key (e.g.,
/api/data?role=user,admin). - If the server processes the crafted request first, its response will be cached under the same key as the legitimate request.
- When the legitimate request is made, it will receive the cached response from the crafted request instead of making a new network call.
For CVE-2026-54266 (Weak 32-bit Hash Collision):
1. Identify a sensitive endpoint (e.g., `/api/user/profile`).
- Use a collision-finding technique to discover a query string that produces the same 32-bit hash (e.g., `q=aaCAZMMM` for a search request).
- Craft a URL that includes this colliding parameter (e.g.,
/search?q=aaCAZMMM). - When a user visits this crafted link, the SSR process will execute both the search and the profile request, and the search response will overwrite the profile response in the cache.
Protection:
- Upgrade Angular: Immediately upgrade to the patched versions:
For CVE-2026-68945: 20.3.27, 21.2.19, or 22.0.2.
For CVE-2026-54266: 20.3.25, 21.2.17, or 22.0.1.
- Per-Request Mitigation: If you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints:
this.http.get('/api/resource', { transferCache: false }); - Global Mitigation: Disable the HTTP transfer cache globally in your application bootstrap config:
import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser'; export const appConfig = { providers: [ provideClientHydration( withNoHttpTransferCache() ) ] };
Impact:
- State Poisoning: The application’s internal state can be corrupted with incorrect or attacker-influenced data, leading to logic errors, UI glitches, or privilege escalation.
- Cross-Request Response Reuse: Cached responses can be reused across semantically different requests, potentially exposing sensitive data from one user to another or allowing an attacker to view data they should not have access to.
- Information Disclosure: An attacker could potentially cause the application to display sensitive information from a different user’s session or from a different part of the application.
- Data Integrity Compromise: The integrity of the data displayed and processed by the application can be compromised, as the application may operate on false or manipulated data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
