CVE-2026-54264
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@angular/service-workernpm | >= 22.0.0-next.0, < 22.0.1 | 22.0.1 |
@angular/service-workernpm | >= 21.0.0-next.0, < 21.2.17 | 21.2.17 |
@angular/service-workernpm | >= 20.0.0-next.0, < 20.3.25 | 20.3.25 |
@angular/service-workernpm | <= 19.2.25 | — |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/angular/angular/commit/47d68dcb26266316647133ab6385e77fc3e5ae08nvdPatchWEB
- github.com/angular/angular/pull/69029nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-qxh6-94w6-9r5pghsaADVISORY
- github.com/angular/angular/security/advisories/GHSA-qxh6-94w6-9r5pnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-54264ghsaADVISORY
News mentions
1- Angular: 14 CVEs Disclosed Across Core Packages — XSS, DoS, SSRF, and Cache PoisoningVypr Intelligence · Jun 15, 2026