Loading story…
A high-severity vulnerability in Angular's @angular/common/http package allows semantically different HttpClient requests to collide on the same HttpTransferCache key during Server-Side Rendering and client-side hydration, enabling cross-request response reuse and client-side state poisoning. The flaw, tracked as CVE-2026-68945, stems from ambiguous query-parameter serialization in cache-key generation, including cases where repeated parameters are comma-joined or attacker-controlled delimiters such as & and = produce identical serialized forms.
The issue is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.8. Angular fixed the bug by replacing custom serialization logic with native URLSearchParams sorting and encoding, and released patched versions 20.3.27, 21.2.19, and 22.0.2; versions prior to those releases are affected. Public references include Angular commits, a pull request, and a GitHub security advisory documenting the remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-68945 was published as a high-severity vulnerability affecting Angular's HttpTransferCache in @angular/common. The flaw allows semantically different requests to collide on the same cache key, enabling cross-request response reuse and client-side state poisoning.
Angular patched the HttpTransferCache cache-key ambiguity issue in @angular/common by replacing custom parameter serialization with native URLSearchParams sorting and encoding. Fixed versions include 20.3.27, 21.2.19, and 22.0.2, and the advisory states the patches were released on the same day.
Angular committed a change to its HTTP transfer cache logic that replaced custom parameter normalization with URLSearchParams sorting and serialization, preventing cache-key collisions between comma-separated scalar values and repeated query parameters. The commit also added a regression test verifying that `role=user,admin` and `role=user&role=admin` are cached distinctly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Angular disclosed a **server-side request forgery (SSRF)** issue in `@angular/platform-server` that affects applications using Server-Side Rendering. The flaw, tracked as `CVE-2026-41423`, stems from improper handling of protocol-relative and backslash-based URLs passed from server engines such as Express into Angular rendering functions. A crafted request can cause Angular to treat an attacker-controlled domain as the application's origin, allowing relative `HttpClient` requests and `PlatformLocation.hostname` references to resolve to external infrastructure. The issue can expose internal services, including private APIs and cloud metadata endpoints, and related advisory material also links the bug family to **header injection** risks in Angular SSR deployments. Angular fixed the vulnerability in versions `19.2.21`, `20.3.19`, `21.2.9`, and `22.0.0-next.8`, leaving earlier releases vulnerable where SSR is enabled and untrusted request paths can influence rendering context.
Jun 29, 2026
A high-severity vulnerability, tracked as CVE-2025-66412, has been discovered in the Angular framework, allowing stored cross-site scripting (XSS) attacks through SVG animation, SVG URL, and MathML attributes. The flaw exists in the Angular Template Compiler, where the internal security schema fails to properly classify certain URL-holding attributes as requiring strict URL security, enabling attackers to inject malicious scripts that bypass Angular's built-in sanitization. This vulnerability affects Angular versions prior to 21.0.2, 20.3.15, and 19.2.17, and has been addressed in these subsequent releases. Attackers exploiting this vulnerability can persistently inject malicious JavaScript into web applications built with vulnerable Angular versions, potentially compromising user data and session integrity. Organizations using Angular are strongly advised to update to the fixed versions to mitigate the risk of exploitation. The vulnerability is remotely exploitable and has been rated as high severity, with a CVSS 4.0 score of 8.5, underscoring the urgency for prompt remediation.
Jun 29, 2026
Nuxt disclosed **CVE-2026-53722**, a reflected DOM-based cross-site scripting flaw in the `<NuxtLink>` component affecting versions before **3.21.7** and **4.4.7**. The bug allowed attacker-controlled values passed into `to` or `href` to be rendered into anchor tags without proper URI scheme sanitization, enabling `javascript:` or `data:` payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into `<NuxtLink>`, and Nuxt fixed it by introducing `sanitizeExternalHref` to block unsafe protocols and abort navigation. Angular also disclosed an SSRF vulnerability in `@angular/platform-server` under **GHSA-rfh7-fxqc-q52v**, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative `HttpClient` requests or `PlatformLocation.hostname` lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include **22.0.0-next.12**, **21.2.13**, **20.3.21**, and **19.2.22**; no fix was listed for the **18.x** line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Jun 29, 2026