8.2

CVE-2026-50170: angular

CVSS: 8.2v4.0HighAnalyzed
AliasesUBUNTU-CVE-2026-50170DEBIAN-CVE-2026-50170CGA-25w4-2fqj-5p66
Published 22-06-2026Last modified 23-06-2026
Open JSON

Vulnerability summary

CVE-2026-50170 is a high (CVSS 8.2) vulnerability in angular. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-5MW5-X2QQ-6FJF

Timeline

  1. 22-06-2026
    PublishedVulnerability first disclosed.
  2. 23-06-2026
    Last modifiedVulnerability information updated.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

CVSS metrics

10 scores · 7 sources · 2 versions

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard10 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
  • katib-suggestion-nas-darts< 0.19.0-r31
Wolfi10 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
  • katib-suggestion-nas-darts< 0.19.0-r31
@angular1 product
  • common≥ 22.0.0-next.0, < 22.0.0-rc.2 | ≥ 20.0.0-next.0, < 20.3.22 | ≥ 19.0.0-next.0, < 19.2.23 | ≤ 18.2.14 | ≥ 21.0.0-next.0, < 21.2.15
Angular1 product
  • angular≥ 22.0.0-next.0, < 22.0.0-rc.2 | ≥ 21.0.0-next.0, < 21.2.15 | ≥ 20.0.0-next.0, < 20.3.22 | ≥ 19.0.0-next.0, < 19.2.23 | ≤ 18.2.14 | ≥ 19.0.0, < 19.2.23 | ≥ 20.0.0, < 20.3.22 | ≥ 21.0.0, < 21.2.15 | 22.0.0:next0 | 22.0.0:next1 | 22.0.0:next10 | 22.0.0:next11 | 22.0.0:next12 | 22.0.0:next2 | 22.0.0:next3 | 22.0.0:next4 | 22.0.0:next5 | 22.0.0:next6 | 22.0.0:next7 | 22.0.0:next8 | 22.0.0:next9 | 22.0.0:rc0 | 22.0.0:rc1
Debian1 product
  • angular.jsAll versions (No fix recorded)
Ubuntu1 product
  • angular.jsAll versions (No fix recorded)

6 vendors · 24 products

References

8 links