5.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50169

CVE-2026-50169: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the browser's default 'follow' strategy. If the target web application makes client-side requests with a strict policy (e.g., expecting a network error instead of automatically following redirects), the service worker will bypass this instruction and automatically follow HTTP 3xx redirects to other destinations. This acts as an unintended proxy/intermediary ("Confused Deputy") and can result in cookie/credential exposure or same-origin session-restricted data leakage if public dynamic routes redirect to sensitive routes. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50169

CVE-2026-50169:

5.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/service-worker	npm	>= 22.0.0-next.0, < 22.0.0-rc.2	22.0.0-rc.2
@angular/service-worker	npm	>= 20.0.0-next.0, < 20.3.22	20.3.22
@angular/service-worker	npm	>= 19.0.0-next.0, < 19.2.23	19.2.23
@angular/service-worker	npm	<= 18.2.14
@angular/service-worker	npm	>= 21.0.0-next.0, < 21.2.15	21.2.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the @angular/service-worker package, where the service worker fails to respect the client-defined redirect policy when intercepting and reconstructing network requests. The analysis of the provided patch commits pinpoints the exact location of the flaw.

The commit 58bf5ecd4ed256d66a3444166d172eeffd38f75f directly addresses the issue. The key change is in the packages/service-worker/worker/src/assets.ts file, specifically within the AssetGroup.newRequestWithMetadata function. Before the patch, this function would create a new Request object preserving only the headers of the original request. The patch modifies this function to also preserve the redirect property from the original request's options.

This confirms that AssetGroup.newRequestWithMetadata is the vulnerable function. When an application makes a fetch request with a strict redirect policy (e.g., {redirect: 'error'}), the service worker intercepts it. The vulnerable version of newRequestWithMetadata then reconstructs this request without the redirect: 'error' policy. Consequently, the browser defaults to its standard redirect: 'follow' behavior. If the original request's URL redirects to a sensitive, authenticated endpoint, the browser will incorrectly follow the redirect, sending along any cookies or authentication headers, leading to a 'Confused Deputy' problem and potential information disclosure.

Vulnerable functions

AssetGroup.newRequestWithMetadata

packages/service-worker/worker/src/assets.ts

The vulnerability exists in the `newRequestWithMetadata` function within the `AssetGroup` class. This function was responsible for reconstructing network requests intercepted by the service worker. The original implementation only preserved the `headers` from the original request, discarding other important security settings like the `redirect` policy. By failing to copy the `redirect` property from the `options` object, it allowed the browser to fall back to its default redirect behavior ('follow'), even if the application developer had explicitly set a stricter policy like 'error' to prevent redirects. This bypass could be exploited to leak credentials.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.