Summary
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
An information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm.
This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin.
Attack Preconditions
For this vulnerability to be exploitable:
- Vulnerable Configuration: The application must utilize the
@angular/service-workerpackage to fetch assets. - Credentialed Requests: The application must attach sensitive request headers (like
Authorization,Proxy-Authorization, or rely on cookies) to asset-group requests. - Redirect Flow: These requests must encounter a cross-origin redirect to an attacker-controlled or untrusted domain.
Patched Versions
- 22.0.1
- 21.2.17
- 20.3.25
Credits
This vulnerability was discovered and reported by CodeMender from Google DeepMind.
Impact
If an application configured with the Angular Service Worker fetches assets with credential headers (such as Authorization header), and one of those requests is redirected to a different origin, the Service Worker will forward those headers to the new origin. This exposes critical credentials and session identifiers to unauthorized third-party servers.
CVE-2026-54264 has a CVSS score of 6.1 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (22.0.1, 21.2.17, 20.3.25); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
@angular/service-worker to 22.0.1 or later; @angular/service-worker to 21.2.17 or later; @angular/service-worker to 20.3.25 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-54264? CVE-2026-54264 is a high-severity security vulnerability in @angular/service-worker (npm), affecting versions >= 22.0.0-next.0, < 22.0.1. It is fixed in 22.0.1, 21.2.17, 20.3.25.
- How severe is CVE-2026-54264? CVE-2026-54264 has a CVSS score of 6.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @angular/service-worker are affected by CVE-2026-54264? @angular/service-worker (npm) versions >= 22.0.0-next.0, < 22.0.1 is affected.
- Is there a fix for CVE-2026-54264? Yes. CVE-2026-54264 is fixed in 22.0.1, 21.2.17, 20.3.25. Upgrade to this version or later.
- Is CVE-2026-54264 exploitable, and should I be worried? Whether CVE-2026-54264 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54264 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54264?
- Upgrade
@angular/service-workerto 22.0.1 or later - Upgrade
@angular/service-workerto 21.2.17 or later - Upgrade
@angular/service-workerto 20.3.25 or later
- Upgrade