CVE-2026-54266

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25

Description Angular's HttpTransferCache caches HTTP requests during Server-Side Rendering (SSR) to be reused during client-side hydration, preventing redundant requests on the client. These responses are stored in TransferState using cache keys generated by hashing request properties, including the method, response type, mapped URL, serialized body, and sorted query parameters. The system uses a weak 32-bit DJB2-like polynomial rolling hash, which has a small hash space that allows for hash collisions.

An attacker can identify a query parameter string, such as q=aaCAZMMM, that produces the same hash as a sensitive endpoint, such as '/api/user/profile'. If a victim visits a crafted link, the SSR process executes both requests, and the attacker-controlled response overwrites the sensitive response in the TransferState cache. This leads to state poisoning, where the application operates with forged data potentially bypassing security controls or causing DOM-based Cross-Site Scripting (XSS), and information leakage, where sensitive data may be disclosed.

Recommendations Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. As a temporary workaround, configure HttpClient requests to set transferCache to false for sensitive endpoints. Alternatively, disable the HTTP transfer cache globally in the application bootstrap configuration using withNoHttpTransferCache() within provideClientHydration().