CVE-2026-50184: Angular: Request Credential & Cache Policy Stripping in Angular Service Worker

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-07-09
Weakness: CWE-200

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Affected products

angular: through 18.2.14; from 19.0.0 before 19.2.23; from 20.0.0 before 20.3.22; from 21.0.0 before 21.2.15; 22.0.0-next0, 22.0.0-next1, 22.0.0-next10, 22.0.0-next11, 22.0.0-next12, 22.0.0-next2 (+9) — fixed in 19.2.23, 20.3.22, 21.2.15

How to fix

Upgrade to a fixed version: angular 19.2.23, 20.3.22, 21.2.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-50184 or the next vulnerability affects your stack