Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in Angular's HttpTransferCache mechanism, which is designed to optimize Server-Side Rendering (SSR) by caching HTTP responses. The root cause of the information leak was the failure to properly identify and exclude user-specific requests from being cached. The analysis of the patches in commits fd68ef1b2107a58f5ae07bc70a06e94b866c4db4 and fbad7133ed1ab67fe2d55343675058a219d2d698 reveals two primary flaws.
First, the hasAuthHeaders function did not consider the Cookie header as an authentication-related header. This meant that requests containing session cookies, which result in user-specific data, were not excluded from the cache. The patch fixed this by adding req.headers.has('cookie') to the check.
Second, the shouldCacheRequest function, which contains the primary caching decision logic, did not check for the withCredentials flag on HTTP requests. This flag also indicates that a request is credentialed and may return private data. The patch added an explicit check for req.withCredentials to prevent these requests from being cached.
The transferCacheInterceptorFn is the high-level interceptor that uses this flawed logic. When a credentialed request is made during SSR, this interceptor calls shouldCacheRequest, which incorrectly approves the request for caching, leading to the sensitive response being stored and potentially served to other users via a shared cache (like a CDN).
shouldCacheRequestpackages/common/http/src/transfer_cache.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @angular/common | npm | >= 22.0.0-next.0, < 22.0.0-rc.2 | 22.0.0-rc.2 |
| @angular/common | npm | >= 20.0.0-next.0, < 20.3.22 | 20.3.22 |
hasAuthHeaderspackages/common/http/src/transfer_cache.ts
transferCacheInterceptorFnpackages/common/http/src/transfer_cache.ts
| @angular/common | npm | >= 19.0.0-next.0, < 19.2.23 | 19.2.23 |
| @angular/common | npm | <= 18.2.14 |
| @angular/common | npm | >= 21.0.0-next.0, < 21.2.15 | 21.2.15 |