Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.28, 21.x prior to 21.2.20 or 22.x prior to 22.1.1. It is, therefore, affected by an information disclosure vulnerability in @angular/common when SSR and hydration are enabled with a hierarchical HttpClient configuration using withRequestsMadeViaParent(). The HttpTransferCache eligibility check is performed before the parent interceptors add credentials, causing credentialed user-specific responses to be cached in the serialized transfer state. (CVE-2026-88059)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's
    @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and
    hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache
    evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an
    Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the
    child still stores the private response in TransferState serialized as JSON in the ng-state script.
    Exploitation requires provideClientHydration, child provideHttpClient delegation through
    withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users
    by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive
    the cached HTML containing the earlier authenticated user's sensitive response data. Applications can
    mitigate by attaching credentials at the child, filtering sensitive endpoints with
    withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized
    HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1. (CVE-2026-88059)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's     @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and     hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache     evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an     Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the     child still stores the private response in TransferState serialized as JSON in the ng-state script.
    Exploitation requires provideClientHydration, child provideHttpClient delegation through     withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users     by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive     the cached HTML containing the earlier authenticated user's sensitive response data. Applications can     mitigate by attaching credentials at the child, filtering sensitive endpoints with     withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized     HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1. (CVE-2026-88059)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115584	Angular < 20.3.28 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
115583	Angular 20.x < 20.3.28 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
115582	Angular 21.x < 21.2.20 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
115581	Angular 22.x < 22.1.1 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
447932	SCA: security update for @angular/common (GHSA-p297-fm68-3q8c)	Tenable Cloud Security	SCA Checks	Local	medium
447932	SCA: security update for @angular/common (GHSA-p297-fm68-3q8c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
344647	Linux Distros Unpatched Vulnerability : CVE-2026-88059	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88059

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium