CVE-2026-68945: CVE-2026-68945: Cache-Key Ambiguity in Angular HttpTransferCache Leading to State Poisoning

CVE-2026-68945: Cache-Key Ambiguity in Angular HttpTransferCache Leading to State Poisoning

Vulnerability ID: CVE-2026-68945
CVSS Score: 8.8
Published: 2026-08-03

An in-depth technical analysis of CVE-2026-68945, a high-severity security vulnerability in Angular's @angular/common/http package. The flaw stems from an ambiguity in how query parameters are serialized to generate cache keys during Server-Side Rendering (SSR) within the HttpTransferCache component. By failing to encode delimiters and implicitly coercing arrays to comma-joined strings, the serialization mechanism yields identical cache keys for distinct requests, facilitating State Poisoning and Cross-Request Response Reuse.

TL;DR

Improper query parameter serialization in Angular's HttpTransferCache yields identical cache keys for semantically different requests, allowing remote attackers to poison application states during SSR hydration.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-345
• Attack Vector: Network
• CVSS Score: 8.8
• Exploit Status: Proof-of-Concept
• Impact: State Poisoning / Cross-Request Response Reuse
• KEV Status: Not Listed

Affected Systems

• Angular applications utilizing Server-Side Rendering (SSR)
• Angular projects using client-side hydration with HttpTransferCache enabled
• @angular/common: < 20.3.27 (Fixed in: 20.3.27)
• @angular/common: >= 21.0.0-next.0, < 21.2.19 (Fixed in: 21.2.19)
• @angular/common: >= 22.0.0-next.0, < 22.0.2 (Fixed in: 22.0.2)

Code Analysis

Commit: 6867f77

fix(common): prevent cache key collision in HttpTransferCache

Commit: 948a8d6

fix(common): prevent cache key collision in HttpTransferCache (branch patch)

Commit: a64e288

fix(common): prevent cache key collision in HttpTransferCache (backport patch)

Commit: a6c7fc5

fix(common): prevent cache key collision in HttpTransferCache (lts patch)

Exploit Details

• Angular GitHub Tests: Official test specifications demonstrating cache collision by asserting differentiation between repeated parameters and scalar comma parameters.

Mitigation Strategies

• Upgrade the @angular/common package to safe release channels to resolve the key-generation flaw.
• Explicitly disable caching for state-sensitive HTTP routes that govern administrative operations or user permissions.
• Audit custom implementation codecs to ensure that all URL queries are encoded uniformly with platform-native APIs.

Remediation Steps:

1. Open the project's dependency manifest (package.json).
2. Update @angular/common to version 20.3.27 or higher for the 20.x release branch.
3. Update @angular/common to version 21.2.19 or higher for the 21.x release branch.
4. Update @angular/common to version 22.0.2 or higher for the 22.x release branch.
5. Run your package manager installation command (e.g., npm install or yarn install) to apply the changes.
6. Deploy the updated application to production and restart the SSR server instances to purge any existing server-side cache stores.

References

• GitHub Security Advisory GHSA-jhpw-976m-542j
• CVE Record on CVE.org

---

Read the full report for CVE-2026-68945 on our website for more details including interactive diagrams and full exploit analysis.