Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.27, 21.x prior to 21.2.19 or 22.x prior to 22.0.2. It is, therefore, affected by a cache-key ambiguity vulnerability in the HttpTransferCache of @angular/common. Repeated request parameter values are serialized identically to comma-separated scalar values, allowing an attacker-influenced request to be replayed as the response of a different security-sensitive request during SSR, leading to state poisoning or data leakage. (CVE-2026-68945)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-
    joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same
    transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19,
    and 22.0.2. (CVE-2026-68945)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-     joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same     transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19,     and 22.0.2. (CVE-2026-68945)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115596	Angular < 20.3.27 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	high
115595	Angular 20.x < 20.3.27 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	high
115594	Angular 21.x < 21.2.19 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	high
115593	Angular 22.x < 22.0.2 Cache Poisoning	Web App Scanning	Component Vulnerability	Version Based	high
445585	SCA: security update for @angular/common (GHSA-jhpw-976m-542j)	Tenable Cloud Security	SCA Checks	Local	high
445585	SCA: security update for @angular/common (GHSA-jhpw-976m-542j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331691	Linux Distros Unpatched Vulnerability : CVE-2026-68945	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68945

high

Tenable Plugins

high

high

high

high

high

high

high