CVE-2026-68945

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

this.http.get('/api/resource', {
  transferCache: false
});

import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

• State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
• Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-68945? CVE-2026-68945 is a high-severity security vulnerability in @angular/common (npm), affecting versions >= 22.0.0-next.0, < 22.0.2. It is fixed in 22.0.2, 21.2.19, 20.3.27.
2. Which versions of @angular/common are affected by CVE-2026-68945? @angular/common (npm) versions >= 22.0.0-next.0, < 22.0.2 is affected.
3. Is there a fix for CVE-2026-68945? Yes. CVE-2026-68945 is fixed in 22.0.2, 21.2.19, 20.3.27. Upgrade to this version or later.
4. Is CVE-2026-68945 exploitable, and should I be worried? Whether CVE-2026-68945 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-68945 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-68945?
   • Upgrade @angular/common to 22.0.2 or later
   • Upgrade @angular/common to 21.2.19 or later
   • Upgrade @angular/common to 20.3.27 or later

Other vulnerabilities in @angular/common