Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @angular/service-worker | npm | >= 22.0.0-next.0, < 22.0.0-rc.2 | 22.0.0-rc.2 |
| @angular/service-worker | npm | >= 21.0.0-next.0, < 21.2.15 | 21.2.15 |
| @angular/service-worker | npm | >= 20.0.0-next.0, < 20.3.22 | 20.3.22 |
| @angular/service-worker | npm | >= 19.0.0-next.0, < 19.2.23 | 19.2.23 |
| @angular/service-worker | npm | <= 18.2.14 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the @angular/service-worker's handling of intercepted network requests. The root cause is within the AssetGroup.newRequestWithMetadata function, located in packages/service-worker/worker/src/assets.ts. This function is responsible for creating a new Request object when the service worker fetches a matched asset from the network.
The vulnerability has two parts, both addressed in the provided patches:
newRequestWithMetadata did not preserve the credentials property from the incoming request's RequestInit options. As a result, if a developer made a fetch call with { credentials: 'omit' } to prevent sending cookies or other credentials, the service worker would ignore this and create a new request with the browser's default, credentials: 'same-origin'. This could cause sensitive session cookies to be sent to endpoints that were not supposed to receive them.cache property. If a request was made with a specific cache policy, such as { cache: 'no-store' } to prevent a sensitive resource from being cached, the service worker would strip this option. This would cause the service worker to cache the response according to its own configuration, potentially leading to private user information being stored in the local cache and persisting even after a user logs out.The patches address these issues by modifying newRequestWithMetadata to explicitly check for and carry over the credentials: 'omit' and cache properties from the original request to the new one it constructs. Therefore, AssetGroup.newRequestWithMetadata is the precise location of the vulnerability.
AssetGroup.newRequestWithMetadatapackages/service-worker/worker/src/assets.ts
assetGroups pattern in ngsw-config.json encompasses the target dynamic routing endpoint.{ credentials: 'omit' } or specific cache control parameters (e.g. { cache: 'no-store' }).If upgrading the @angular/service-worker package is not immediately feasible, developers should implement the following defensive measures:
SameSite=Strict; Secure; HttpOnly) and ensure complete route isolation for credential-guarded secure resources.ngsw-config.json.if ('caches' in window) {
caches.keys().then(names => {
for (let name of names) {
if (name.startsWith('ngsw:')) {
caches.delete(name);
}
}
});
}