CVE-2026-68945

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.

This vulnerability is rated Important because unauthenticated remote clients can trigger cache key collisions during server-side rendering, potentially allowing unauthorized data disclosure or privilege confusion across sessions. The risk is heightened when server rendering processes requests containing repeated query parameters alongside untrusted inputs. However, exploitation is limited to environments utilizing Angular Server-Side Rendering (SSR) with transfer caching enabled; applications serving purely client-side single-page bundles are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.