What is CVE-2026-50184?

CVE-2026-50184 is a medium-severity security vulnerability in @angular/service-worker (npm), affecting versions >= 22.0.0-next.0, < 22.0.0-rc.2. It is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23.

How severe is CVE-2026-50184?

CVE-2026-50184 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of @angular/service-worker are affected by CVE-2026-50184?

@angular/service-worker (npm) versions >= 22.0.0-next.0, < 22.0.0-rc.2 is affected.

Is there a fix for CVE-2026-50184?

Yes. CVE-2026-50184 is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23. Upgrade to this version or later.

Is CVE-2026-50184 exploitable, and should I be worried?

Whether CVE-2026-50184 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-50184 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-50184?

Upgrade: @angular/service-worker to 22.0.0-rc.2 or later, @angular/service-worker to 21.2.15 or later, @angular/service-worker to 20.3.22 or later, @angular/service-worker to 19.2.23 or later.

CVE-2026-50184 in @angular/service-worker

Q: How severe is CVE-2026-50184?

CVE-2026-50184 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of @angular/service-worker are affected by CVE-2026-50184?

@angular/service-worker (npm) versions >= 22.0.0-next.0, < 22.0.0-rc.2 is affected.

Q: Is there a fix for CVE-2026-50184?

Yes. CVE-2026-50184 is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23. Upgrade to this version or later.

Q: Is CVE-2026-50184 exploitable, and should I be worried?

Whether CVE-2026-50184 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-50184 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-50184?

Upgrade: @angular/service-worker to 22.0.0-rc.2 or later, @angular/service-worker to 21.2.15 or later, @angular/service-worker to 20.3.22 or later, @angular/service-worker to 19.2.23 or later.

Summary

@angular/service-worker: Request Credential & Cache Policy Stripping

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function.

During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties).

This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout.

Attack Preconditions

To successfully exploit this vulnerability, all of the following application states and parameters must concurrently exist:

Active Angular Service Worker: The target application uses @angular/service-worker and has an active registration of ngsw-worker.js inside the client's browser context.
Asset Group Matching: An assetGroups pattern in ngsw-config.json encompasses the target dynamic routing endpoint.
Established User Session: The victim user currently has an active authentication state, such as valid same-origin session cookies or auth headers stored by the browser.
Client-Side Safe Fetch Call: The application initiates an explicit fetch request to the route with safety parameters: { credentials: 'omit' } or specific cache control parameters (e.g. { cache: 'no-store' }).

Mitigations & Workarounds

If upgrading the @angular/service-worker package is not immediately feasible, developers should implement the following defensive measures:

Strict Cookie Configuration: Apply strict flags to session cookies (SameSite=Strict; Secure; HttpOnly) and ensure complete route isolation for credential-guarded secure resources.
Exclude Secure Endpoints from SW Config: Ensure that patterns targeting dynamic, secure endpoints are explicitly excluded from automatic asset groups or caching scopes in your ngsw-config.json.

Post-Logout Cache Invalidation: Programmatically purge the browser's Cache Storage API entries registered by the Angular Service Worker upon user logout:

if ('caches' in window) {
  caches.keys().then(names => {
    for (let name of names) {
      if (name.startsWith('ngsw:')) {
        caches.delete(name);
      }
    }
  });
}

Impact

Web applications registering the @angular/service-worker package are vulnerable to credential exposure or post-logout cache persistence if client-side code relies on fetch calls with explicit safety attributes (such as { credentials: 'omit' } or { cache: 'no-store' }) targeting paths matched by service worker asset groups.

By stripping these safety boundaries, the service worker exposes same-origin cookies and dynamic sensitive data to endpoints that should not receive them, or retains dynamic user sessions in cache storage where logout operations fail to fully evict user records.

CVE-2026-50184 has a CVSS score of 6.1 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23); upgrading removes the vulnerable code path.

Affected versions

@angular/service-worker (>= 22.0.0-next.0, < 22.0.0-rc.2) @angular/service-worker (>= 21.0.0-next.0, < 21.2.15) @angular/service-worker (>= 20.0.0-next.0, < 20.3.22) @angular/service-worker (>= 19.0.0-next.0, < 19.2.23) @angular/service-worker (<= 18.2.14)

Security releases

@angular/service-worker → 22.0.0-rc.2 (npm) @angular/service-worker → 21.2.15 (npm) @angular/service-worker → 20.3.22 (npm) @angular/service-worker → 19.2.23 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Frequently Asked Questions

What is CVE-2026-50184? CVE-2026-50184 is a medium-severity security vulnerability in @angular/service-worker (npm), affecting versions >= 22.0.0-next.0, < 22.0.0-rc.2. It is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23.
How severe is CVE-2026-50184? CVE-2026-50184 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of @angular/service-worker are affected by CVE-2026-50184? @angular/service-worker (npm) versions >= 22.0.0-next.0, < 22.0.0-rc.2 is affected.
Is there a fix for CVE-2026-50184? Yes. CVE-2026-50184 is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23. Upgrade to this version or later.
Is CVE-2026-50184 exploitable, and should I be worried? Whether CVE-2026-50184 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-50184 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-50184?
- Upgrade @angular/service-worker to 22.0.0-rc.2 or later
- Upgrade @angular/service-worker to 21.2.15 or later
- Upgrade @angular/service-worker to 20.3.22 or later
- Upgrade @angular/service-worker to 19.2.23 or later

Other vulnerabilities in @angular/service-worker

CVE-IDSeverityPackage summary

CVE-2026-54264High@angular/service-worker: @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CVE-2026-50169Medium@angular/service-worker: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities