Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's
    @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and
    hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache
    evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an
    Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the
    child still stores the private response in TransferState serialized as JSON in the ng-state script.
    Exploitation requires provideClientHydration, child provideHttpClient delegation through
    withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users
    by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive
    the cached HTML containing the earlier authenticated user's sensitive response data. Applications can
    mitigate by attaching credentials at the child, filtering sensitive endpoints with
    withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized
    HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1. (CVE-2026-88059)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's     @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and     hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache     evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an     Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the     child still stores the private response in TransferState serialized as JSON in the ng-state script.
    Exploitation requires provideClientHydration, child provideHttpClient delegation through     withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users     by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive     the cached HTML containing the earlier authenticated user's sensitive response data. Applications can     mitigate by attaching credentials at the child, filtering sensitive endpoints with     withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized     HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1. (CVE-2026-88059)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447932	SCA: security update for @angular/common (GHSA-p297-fm68-3q8c)	Tenable Cloud Security	SCA Checks	Local	medium
447932	SCA: security update for @angular/common (GHSA-p297-fm68-3q8c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
344647	Linux Distros Unpatched Vulnerability : CVE-2026-88059	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88059

medium

Tenable Plugins

medium

medium

medium