Catalogo CVE

CVE-2026-50170

Angular is a development platform for building mobile…

[Catalogo CVE]

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Gravità
High · CVSS 8.2
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debiantrixieangular.js1.8.3-3Unknown[CVE-2026-50170]
Debiansidangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debiansidangular.js1.8.3-3Unknown[CVE-2026-50170]
Debianbookwormangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debianbookwormangular.js1.8.3-1+deb12u1Unknown[CVE-2026-50170]
UnknownRelease not reportedangularNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular19.2.23UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular20.3.22UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular21.2.15UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular.jsNot reportedUnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedangularNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular19.2.23UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular20.3.22UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular21.2.15UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedangular.jsNot reportedUnknownSource applicability is not establishedProvider not reported
Debianbookwormangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debianbookwormangular.js1.8.3-1+deb12u1Unknown[CVE-2026-50170]
Debiansidangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debiansidangular.js1.8.3-3Unknown[CVE-2026-50170]
Debiantrixieangular.jsNot reportedAffectedDistribution reports no fix[CVE-2026-50170]
Debiantrixieangular.js1.8.3-3Unknown[CVE-2026-50170]
Original provider fields
{
  "package_releases": [
    {
      "name": "angular.js",
      "status": "unknown",
      "release": "sid",
      "version": "1.8.3-3"
    },
    {
      "name": "angular.js",
      "status": "unknown",
      "release": "trixie",
      "version": "1.8.3-3"
    },
    {
      "name": "angular.js",
      "status": "unknown",
      "release": "bookworm",
      "version": "1.8.3-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "angular.js",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "angular.js",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "angular.js",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "angular.js",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "angular",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "angular",
      "fixed_version": "19.2.23",
      "applicability_unknown": true
    },
    {
      "name": "angular",
      "fixed_version": "20.3.22",
      "applicability_unknown": true
    },
    {
      "name": "angular",
      "fixed_version": "21.2.15",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjs-angularjs]Interessata

    Pacchetto sorgente: [angular.js]

    Dettagli (2)

    • 1.8.3-1+deb12u1 · all · bookworm

      Interessata

      nvd · angular.js · debian · bookworm; pypi · angular.js · debian · 12

    • 1.8.3-1+deb12u1 · all · bookworm

      Interessata

      nvd · angular.js · debian · bookworm; pypi · angular.js · debian · 12

[Debian 13 (Trixie)]

  • [libjs-angularjs]Interessata

    Pacchetto sorgente: [angular.js]

    Dettagli (2)

    • 1.8.3-3 · all · trixie

      Interessata

      nvd · angular.js · debian · bookworm; pypi · angular.js · debian · 13

    • 1.8.3-3 · all · trixie

      Interessata

      nvd · angular.js · debian · bookworm; pypi · angular.js · debian · 13

Osservato:

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]