Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the HttpTransferCache mechanism of Angular, specifically in how cache keys are generated for HTTP requests with parameters. The analysis of the provided patches shows that the sortAndConcatParams function in packages/common/http/src/transfer_cache.ts incorrectly serialized query parameters. It used params.getAll(k), which would join multiple values for a parameter with a comma. This created a situation where two semantically different requests, one with a parameter like role=user,admin and another with role=user&role=admin, would result in the same cache key. This ambiguity could be exploited to poison the cache, causing an application to use a malicious or incorrect response from a previous request. The patch replaces this logic with new URLSearchParams(params.toString()).toString(), which correctly serializes the parameters, preserving the distinction between the two cases. The function makeCacheKey is also identified as a vulnerable function because it directly calls sortAndConcatParams to construct the cache key. An attacker could craft a request that gets cached and then serve that cached response to a legitimate user's request, leading to state poisoning or cross-request response reuse.
sortAndConcatParamspackages/common/http/src/transfer_cache.ts
makeCacheKeypackages/common/http/src/transfer_cache.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @angular/common | npm | >= 22.0.0-next.0, < 22.0.2 | 22.0.2 |
| @angular/common | npm | >= 21.0.0-next.0, < 21.2.19 | 21.2.19 |
| @angular/common | npm | >= 20.0.0-next.0, < 20.3.27 | 20.3.27 |
| @angular/common | npm | <= 19.2.25 |