GHSA-39pv-4j6c-2g6v
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/common | 0 | No fix |
| npm | @angular/common | 20.0.0-next.0 | 20.3.25 |
| npm | @angular/common | 21.0.0-next.0 | 21.2.17 |
| npm | @angular/common | 22.0.0-next.0 | 22.0.1 |
Related vulnerabilities
- CVE-2026-54266 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50170 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- CVE-2026-50171 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- CVE-2026-54268 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/common
- GHSA-48r7-hpm6-gfxm @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) Also affects @angular/common
- GHSA-p3vc-36g9-x9gr @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) Also affects @angular/common
- GHSA-q6f4-qqrg-jv6x @angular/common: Information Leak via Default Caching of Credentialed Requests in… Also affects @angular/common
- GHSA-58c5-g7wp-6w37 Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP… Also affects @angular/common