CVE-2026-54264 Details
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
A vulnerability allowing information disclosure has been identified in the Angular framework's @angular/service-worker package, affecting versions 20.0.0-next.0 prior to 20.3.25, 21.0.0-next.0 prior to 21.2.17, and 22.0.0-next.0 prior to 22.0.1. The issue arises when the Service Worker fetches assets and retains metadata, including sensitive headers, from the original request. On cross-origin redirects, the Service Worker improperly forwards sensitive headers such as Authorization tokens, Proxy-Authorization credentials, and session cookies to untrusted external origins, violating the Fetch redirect algorithm. This vulnerability allows remote attackers to intercept critical credentials by triggering cross-origin redirects to malicious sites.
Users can upgrade to Angular versions 22.0.1, 21.2.17, or 20.3.25 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/angular/angular/commit/47d68dcb26266316647133ab6385e77fc3e5ae08 | [email protected] | Patch |
| https://github.com/angular/angular/pull/69029 | [email protected] | Issue TrackingPatch |
| https://github.com/angular/angular/security/advisories/GHSA-qxh6-94w6-9r5p | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| angular angular | <= 19.2.25 >= 20.0.0, < 20.3.25 >= 21.0.0, < 21.2.17 >= 22.0.0, < 22.0.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Reanalysis | [email protected] |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |