Angular's `HttpTransferCache` caches HTTP requests during Server-Side Rendering (SSR) to be reused during client-side hydration, preventing redundant requests on the client. These responses are stored in `TransferState` using cache keys generated by hashing request properties, including the method, response type, mapped URL, serialized body, and sorted query parameters. The system uses a weak 32-bit DJB2-like polynomial rolling hash, which has a small hash space that allows for hash collisions.
An attacker can identify a query parameter string, such as `q=aaCAZMMM`, that produces the same hash as a sensitive endpoint, such as '/api/user/profile'. If a victim visits a crafted link, the SSR process executes both requests, and the attacker-controlled response overwrites the sensitive response in the `TransferState` cache. This leads to state poisoning, where the application operates with forged data potentially bypassing security controls or causing DOM-based Cross-Site Scripting (XSS), and information leakage, where sensitive data may be disclosed.