CVE-2026-50184

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CWE-200
• CWE-524

• https://github.com/angular/angular/pull/68904Issue Tracking, Patch
• https://github.com/angular/angular/security/advisories/GHSA-95qp-cmmw-mgqvThird Party Advisory

Published

Jun 22, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50179Actual is a local-first personal finance tool. Prior to 26.6…4.2
• CVE-2026-5018A weakness has been identified in code-projects Simple Food …9.8
• CVE-2026-50180Langroid is a framework for building large-language-model-po…8.7
• CVE-2026-50181Langroid is a framework for building large-language-model-po…7.1
• CVE-2026-50182WWBN AVideo is an open source video platform. Versions prior…6.1
• CVE-2026-50183WWBN AVideo is an open source video platform. Versions 29.0 …4.7
• CVE-2026-50185RustCrypto CMOV provides conditional move CPU intrinsics whi…3.3
• CVE-2026-501864gaBoards is a boards system for realtime project management…8.8
• CVE-2026-50187Oh My Zsh is a community-driven framework for managing Zsh c…8.8
• CVE-2026-50188Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-50189Appsmith is a platform to build admin panels, internal tools…7.2
• CVE-2026-5019A security vulnerability has been detected in code-projects …9.8