CVE-2026-68945: Angular Auth Bypass Vulnerability

CVE-2026-68945 Overview

CVE-2026-68945 is a high-severity flaw in Angular's HttpTransferCache mechanism, the component that ships server-rendered HTTP responses to the browser to avoid duplicate requests during hydration. The sortAndConcatParams function comma-joins values for repeated request parameters when constructing the cache key. As a result, semantically distinct HttpClient requests collide on the same transfer-cache key and receive the wrong cached backend response. This affects applications using Angular versions prior to 20.3.27, 21.2.19, and 22.0.2, and is tracked as [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Server-rendered Angular applications can serve one user's cached HTTP response to another request path, exposing sensitive backend data across users, sessions, or query contexts.

Affected Products

Angular versions prior to 20.3.27
Angular versions prior to 21.2.19
Angular versions prior to 22.0.2

Discovery Timeline

2026-08-03 - CVE-2026-68945 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68945

Vulnerability Analysis

Angular's HttpTransferCache stores backend responses on the server and replays them on the client to avoid duplicate network calls during hydration. Cache lookups are keyed by a serialized combination of URL, method, response type, and request parameters. The parameter serializer produced by sortAndConcatParams calls params.getAll(k) for each unique key and joins the resulting array with HttpParams' default comma separator.

Because getAll returns an array coerced to a string, two structurally distinct parameter sets can produce identical serialized keys. A request with ?tag=a,b and a request with ?tag=a&tag=b collapse to the same key tag=a,b. When both are issued during server-side rendering, the second lookup returns the first request's cached response body, causing cross-request data confusion.

Root Cause

The defective logic lives in packages/common/http/src/transfer_cache.ts. The original sortAndConcatParams implementation iterated unique parameter keys and stringified all values in a single flat join, discarding the boundary between repeated occurrences. Under [CWE-345], the cache key fails to authenticate the semantic identity of the request, so unrelated requests are treated as equivalent by the cache.

Attack Vector

An unauthenticated network attacker can trigger the confusion by crafting URLs with repeated query parameters against a server-rendered Angular application. When the server-side render populates the transfer cache, subsequent HttpClient requests that share the collapsed key inherit the earlier response. This can leak per-user or per-tenant data returned by the backend into responses served to other visitors during the same render window.

typescript

// Vulnerable serializer (before patch)
function sortAndConcatParams(params: HttpParams | URLSearchParams): string {
  return [...params.keys()]
    .sort()
    .map((k) => `${k}=${params.getAll(k)}`)
    .join('&');
}

// Patched serializer (after fix)
function sortAndConcatParams(params: HttpParams | URLSearchParams): string {
  const searchParams = new URLSearchParams(
    params instanceof URLSearchParams ? params : params.toString(),
  );
  searchParams.sort();
  return searchParams.toString();
}

Source: Angular Commit 6867f77. The patch replaces the manual join with URLSearchParams, which preserves each repeated key/value pair independently in the serialized cache key.

Detection Methods for CVE-2026-68945

Indicators of Compromise

Server-rendered pages returning HTTP response bodies that do not match the requested query parameters or filter set.
Application logs showing multiple distinct HttpClient requests with repeated parameters (for example ?id=1&id=2) served identical response payloads.
User reports of seeing another user's or tenant's data during initial page load, before client-side rehydration completes.

Detection Strategies

Inventory Angular applications and identify versions below 20.3.27, 21.2.19, and 22.0.2 using package manifests and lockfiles.
Grep application source for withHttpTransferCacheOptions or default hydration configuration, since the vulnerable cache is active whenever transfer cache is enabled.
Add integration tests that issue two requests differing only by repeated parameter structure and assert that responses are not identical.

Monitoring Recommendations

Instrument SSR request logs to record the full raw query string and correlate cache hits with the originating URL.
Alert on backend responses whose payload user or tenant identifiers do not match the request context in server-rendered flows.
Track deployed Angular runtime versions in your software bill of materials and flag any hosts still running vulnerable releases.

How to Mitigate CVE-2026-68945

Immediate Actions Required

Upgrade Angular to 20.3.27, 21.2.19, or 22.0.2 depending on your current major line.
Audit any application using provideClientHydration with the HTTP transfer cache enabled and review the GHSA-jhpw-976m-542j advisory.
Purge existing server-side render caches and CDN caches that may contain responses generated under the vulnerable serializer.

Patch Information

The fix is delivered in Angular pull request #68571 and applied across the 20.x commit a6c7fc5, 21.x commit a64e2883, and 22.x commit 6867f77. The patched sortAndConcatParams uses URLSearchParams to preserve repeated parameter pairs uniquely in cache keys.

Workarounds

Disable the HTTP transfer cache by removing withHttpTransferCacheOptions or setting provideClientHydration() without transfer cache options until upgrade is possible.
Filter or normalize incoming query parameters at the edge to reject requests with repeated parameter keys for sensitive backend endpoints.
Route responses containing user-specific data through APIs excluded from transfer cache via the includeHeaders and filter options.

bash

# Upgrade Angular in your project to a patched release
npm install @angular/common@22.0.2 @angular/core@22.0.2
# or for the 21.x line
npm install @angular/common@21.2.19 @angular/core@21.2.19
# or for the 20.x line
npm install @angular/common@20.3.27 @angular/core@20.3.27

# Verify installed version
npm ls @angular/common