Common Weakness Enumeration
CWE-524
AllowedUse of Cache Containing Sensitive Information
Abstraction: Base · Status: Incomplete
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
118 vulnerabilities reference this CWE, most recent first.
GHSA-HXJP-2XF5-WMRJ
Vulnerability from github – Published: 2025-09-03 15:30 – Updated: 2026-05-06 18:30
VLAI
Details
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-9901"
],
"database_specific": {
"cwe_ids": [
"CWE-524"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T13:15:50Z",
"severity": "MODERATE"
},
"details": "A flaw was found in libsoup\u2019s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.",
"id": "GHSA-hxjp-2xf5-wmrj",
"modified": "2026-05-06T18:30:23Z",
"published": "2025-09-03T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9901"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-9901"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392790"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/453"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J75R-XRR2-RGP6
Vulnerability from github – Published: 2024-02-10 03:30 – Updated: 2025-06-03 21:30
VLAI
Details
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-45696"
],
"database_specific": {
"cwe_ids": [
"CWE-524"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-10T03:15:07Z",
"severity": "MODERATE"
},
"details": "Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.",
"id": "GHSA-j75r-xrr2-rgp6",
"modified": "2025-06-03T21:30:34Z",
"published": "2024-02-10T03:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45696"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0109082"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR45-8VMC-QM54
Vulnerability from github – Published: 2026-08-03 19:32 – Updated: 2026-08-03 19:32
VLAI
Summary
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
Details
Impact
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.
Patches
Upgrade to undici v7.29.0 or v8.9.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.29.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-14643"
],
"database_specific": {
"cwe_ids": [
"CWE-436",
"CWE-524"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-03T19:32:12Z",
"nvd_published_at": "2026-07-29T22:16:52Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nUndici\u0027s cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache =\"authorization\"` (OWS before `=`) or `no-cache= \"authorization\"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user\u0027s authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`.\n\n## Patches\n\nUpgrade to undici v7.29.0 or v8.9.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.",
"id": "GHSA-jr45-8vmc-qm54",
"modified": "2026-08-03T19:32:12Z",
"published": "2026-08-03T19:32:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14643"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodejs/undici"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v7.29.0"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v8.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives"
}
GHSA-M36G-FVPC-HVM4
Vulnerability from github – Published: 2026-01-16 21:30 – Updated: 2026-01-17 00:30
VLAI
Details
An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-69581"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-524"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-16T20:15:49Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.",
"id": "GHSA-m36g-fvpc-hvm4",
"modified": "2026-01-17T00:30:24Z",
"published": "2026-01-16T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69581"
},
{
"type": "WEB",
"url": "https://github.com/Rivek619/CVE-2025-69581"
},
{
"type": "WEB",
"url": "https://github.com/chamilo/chamilo-lms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M52J-G5RM-PWW7
Vulnerability from github – Published: 2023-08-08 03:30 – Updated: 2024-09-29 00:30
VLAI
Details
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-37486"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-524"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-08T01:15:17Z",
"severity": "HIGH"
},
"details": "Under certain conditions\u00a0SAP Commerce\u00a0(OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.\n\n",
"id": "GHSA-m52j-g5rm-pww7",
"modified": "2024-09-29T00:30:57Z",
"published": "2023-08-08T03:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37486"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3341934"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M9W6-WP3H-VQ8G
Vulnerability from github – Published: 2024-04-25 18:30 – Updated: 2024-09-12 00:31
VLAI
Summary
CoreDNS may return invalid cache entries
Details
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.
Severity
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.11.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/coredns/coredns"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-0874"
],
"database_specific": {
"cwe_ids": [
"CWE-524"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T19:57:51Z",
"nvd_published_at": "2024-04-25T17:15:47Z",
"severity": "MODERATE"
},
"details": "A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.",
"id": "GHSA-m9w6-wp3h-vq8g",
"modified": "2024-09-12T00:31:22Z",
"published": "2024-04-25T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0874"
},
{
"type": "WEB",
"url": "https://github.com/coredns/coredns/issues/6186"
},
{
"type": "WEB",
"url": "https://github.com/coredns/coredns/pull/6354"
},
{
"type": "WEB",
"url": "https://github.com/coredns/coredns/commit/997c7f953962d47c242273f0e41398fdfb5b0151"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4850"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6009"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:6406"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0874"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219234"
},
{
"type": "PACKAGE",
"url": "https://github.com/coredns/coredns"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": " CoreDNS may return invalid cache entries"
}
GHSA-MCGQ-5C2Q-CHC3
Vulnerability from github – Published: 2025-11-04 03:30 – Updated: 2025-12-17 21:30
VLAI
Details
The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A website may exfiltrate image data cross-origin.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-43392"
],
"database_specific": {
"cwe_ids": [
"CWE-524",
"CWE-942"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-04T02:15:46Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A website may exfiltrate image data cross-origin.",
"id": "GHSA-mcgq-5c2q-chc3",
"modified": "2025-12-17T21:30:33Z",
"published": "2025-11-04T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125632"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125633"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125634"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125637"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125638"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125639"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125640"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MQ64-J8F9-9GCJ
Vulnerability from github – Published: 2026-06-09 06:31 – Updated: 2026-07-30 15:24
VLAI
Summary
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
Details
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Severity
5.9 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.2.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.2.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"last_affected": "6.1.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"last_affected": "6.1.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.3.39"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.3.39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41841"
],
"database_specific": {
"cwe_ids": [
"CWE-524"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-30T15:24:41Z",
"nvd_published_at": "2026-06-09T05:16:36Z",
"severity": "MODERATE"
},
"details": "Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.",
"id": "GHSA-mq64-j8f9-9gcj",
"modified": "2026-07-30T15:24:41Z",
"published": "2026-06-09T06:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41841"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-framework"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-41841"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
}
GHSA-MVWP-XPR9-3MWJ
Vulnerability from github – Published: 2025-12-12 21:31 – Updated: 2025-12-17 21:30
VLAI
Details
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2. An attacker with physical access may be able to view deleted notes.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-43410"
],
"database_specific": {
"cwe_ids": [
"CWE-524"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-12T21:15:54Z",
"severity": "LOW"
},
"details": "The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2. An attacker with physical access may be able to view deleted notes.",
"id": "GHSA-mvwp-xpr9-3mwj",
"modified": "2025-12-17T21:30:42Z",
"published": "2025-12-12T21:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43410"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125635"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125636"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125886"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P297-FM68-3Q8C
Vulnerability from github – Published: 2026-09-10 20:19 – Updated: 2026-09-10 20:19
VLAI
Summary
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Details
A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent().
The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState (serialized as JSON in <script id="ng-state">). Following the remediation of CVE-2026-50170, HttpTransferCache automatically skips caching requests that contain authentication headers or credentials (Authorization, Cookie, withCredentials, etc.).
However, when a child HttpClient delegates to a parent client via withRequestsMadeViaParent(), the child's TransferCache interceptor evaluates whether the request is eligible for caching before delegating to the parent client's interceptor chain.
If an outgoing request originates as anonymous from the child client, the child TransferCache marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an Authorization header or API token), the parent TransferCache correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child TransferCache still stores the response in TransferState based on its initial pre-delegation evaluation.
Impact
Successful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when:
- During SSR, a child
HttpClientinitiates an unauthenticated request that is subsequently authenticated by a parent interceptor. - The authenticated response body is cached into the SSR-rendered HTML page (
TransferState). - The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions.
- Subsequent visitors requesting the same page receive the cached HTML containing the previous user's private data.
Attack Preconditions & Vulnerable Configurations
An application is affected only if all of the following conditions are met:
- SSR and Hydration Enabled: The application uses Server-Side Rendering with hydration enabled (e.g., via
provideClientHydration()). - Hierarchical
HttpClientwith Delegation: The application configures a childHttpClientusingwithRequestsMadeViaParent(). - Parent-Level Authentication Injection: Authentication credentials (such as
Authorizationheaders, session cookies, or custom API tokens filtered viawithHttpTransferCacheOptions) are attached by an interceptor in the parent injector chain rather than on the initial child request. - Shared HTML Caching: The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache).
Vulnerable Code Pattern Example
// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
providers: [
provideHttpClient(
// Parent interceptor attaches sensitive Authorization header
withInterceptors([
(req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
])
),
],
};
// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
[
// Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
provideHttpClient(withRequestsMadeViaParent()),
],
parentInjector
).get(HttpClient);
// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();
Patches
The issue is resolved by updating @angular/common to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring HttpTransferCache evaluates cache eligibility after parent request interceptors run.
22.1.121.2.2020.3.28
Workarounds & Mitigations
For applications that cannot immediately upgrade to a patched version, use one of the following mitigations:
- Attach Credentials Before or Within the Child Client: Ensure authentication headers (e.g.,
Authorization) are attached directly when constructing the request or via an interceptor configured directly on the childHttpClient, rather than relying solely on parent interceptors. - Apply Explicit Cache Filters on the Child Client: Configure
withHttpTransferCacheOptionswith a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data:ts provideClientHydration( withHttpTransferCacheOptions({ filter: (req) => !req.url.includes('/api/private/'), }) ) - Disable HTTP Transfer Cache for Sensitive Routes: If specific SSR routes handle user-authenticated data, disable transfer caching for those requests or ensure the SSR response sets
Cache-Control: no-store/privateheaders at your edge/CDN layer so personalized HTML is never shared.
Severity
4.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@angular/common"
},
"ranges": [
{
"events": [
{
"introduced": "22.0.0"
},
{
"fixed": "22.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/common"
},
"ranges": [
{
"events": [
{
"introduced": "21.0.0"
},
{
"fixed": "21.2.20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/common"
},
"ranges": [
{
"events": [
{
"introduced": "20.0.0"
},
{
"fixed": "20.3.28"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "19.2.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-88059"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-524"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T20:19:19Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A security bypass vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical `HttpClient` configuration with `withRequestsMadeViaParent()`.\n\nThe `HttpTransferCache` utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via `TransferState` (serialized as JSON in `\u003cscript id=\"ng-state\"\u003e`). Following the remediation of [CVE-2026-50170](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x), `HttpTransferCache` automatically skips caching requests that contain authentication headers or credentials (`Authorization`, `Cookie`, `withCredentials`, etc.).\n\nHowever, when a child `HttpClient` delegates to a parent client via `withRequestsMadeViaParent()`, the child\u0027s `TransferCache` interceptor evaluates whether the request is eligible for caching **before** delegating to the parent client\u0027s interceptor chain. \n\nIf an outgoing request originates as anonymous from the child client, the child `TransferCache` marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an `Authorization` header or API token), the parent `TransferCache` correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child `TransferCache` still stores the response in `TransferState` based on its initial pre-delegation evaluation.\n\n### Impact\n\nSuccessful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when:\n\n1. During SSR, a child `HttpClient` initiates an unauthenticated request that is subsequently authenticated by a parent interceptor.\n2. The authenticated response body is cached into the SSR-rendered HTML page (`TransferState`).\n3. The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions.\n4. Subsequent visitors requesting the same page receive the cached HTML containing the previous user\u0027s private data.\n\n### Attack Preconditions \u0026 Vulnerable Configurations\n\nAn application is affected only if **all** of the following conditions are met:\n\n* **SSR and Hydration Enabled:** The application uses Server-Side Rendering with hydration enabled (e.g., via `provideClientHydration()`).\n* **Hierarchical `HttpClient` with Delegation:** The application configures a child `HttpClient` using `withRequestsMadeViaParent()`.\n* **Parent-Level Authentication Injection:** Authentication credentials (such as `Authorization` headers, session cookies, or custom API tokens filtered via `withHttpTransferCacheOptions`) are attached by an interceptor in the **parent** injector chain rather than on the initial child request.\n* **Shared HTML Caching:** The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache).\n\n#### Vulnerable Code Pattern Example\n\n```ts\n// Parent Injector / Application Config\nexport const appConfig: ApplicationConfig = {\n providers: [\n provideHttpClient(\n // Parent interceptor attaches sensitive Authorization header\n withInterceptors([\n (req, next) =\u003e next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))\n ])\n ),\n ],\n};\n\n// Child Injector / Feature or Component Config\nconst childClient = createEnvironmentInjector(\n [\n // Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs\n provideHttpClient(withRequestsMadeViaParent()),\n ],\n parentInjector\n).get(HttpClient);\n\n// Request originates without auth headers -\u003e marked cacheable by child TransferCache\nchildClient.get(\u0027/api/user/profile\u0027).subscribe();\n```\n\n### Patches\n\nThe issue is resolved by updating `@angular/common` to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring `HttpTransferCache` evaluates cache eligibility after parent request interceptors run.\n\n* `22.1.1`\n* `21.2.20`\n* `20.3.28`\n\n### Workarounds \u0026 Mitigations\n\nFor applications that cannot immediately upgrade to a patched version, use one of the following mitigations:\n\n1. **Attach Credentials Before or Within the Child Client:** Ensure authentication headers (e.g., `Authorization`) are attached directly when constructing the request or via an interceptor configured directly on the child `HttpClient`, rather than relying solely on parent interceptors.\n2. **Apply Explicit Cache Filters on the Child Client:** Configure `withHttpTransferCacheOptions` with a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data:\n ```ts\n provideClientHydration(\n withHttpTransferCacheOptions({\n filter: (req) =\u003e !req.url.includes(\u0027/api/private/\u0027),\n })\n )\n ```\n3. **Disable HTTP Transfer Cache for Sensitive Routes:** If specific SSR routes handle user-authenticated data, disable transfer caching for those requests or ensure the SSR response sets `Cache-Control: no-store` / `private` headers at your edge/CDN layer so personalized HTML is never shared.",
"id": "GHSA-p297-fm68-3q8c",
"modified": "2026-09-10T20:19:20Z",
"published": "2026-09-10T20:19:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/issues/69777"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/pull/69778"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56"
},
{
"type": "PACKAGE",
"url": "https://github.com/angular/angular"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/releases/tag/v20.3.28"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/releases/tag/v21.2.20"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/releases/tag/v22.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`"
}
Mitigation
Architecture and Design
Protect information stored in cache.
Mitigation
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Mitigation
Architecture and Design
Consider using encryption in the cache.
CAPEC-204: Lifting Sensitive Data Embedded in Cache
An adversary examines a target application's cache, or a browser cache, for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.