CVE-2026-50169: Angular Service Worker Redirect Policy Bypass Vulnerability

Technical summary

The vulnerability exists in the @angular/service-worker package's request reconstruction logic. When intercepting and reprocessing network requests for matched service-worker assets, an internal helper function fails to preserve the original Request object's redirect policy property. Specifically, client-defined policies like redirect: 'error' (which signals that redirect responses should be treated as network errors) are discarded, and the browser default redirect: 'follow' is applied instead. This causes the Service Worker to act as an unintended proxy, automatically following HTTP 3xx responses without respecting the application's intended security posture. The flaw is classified under CWE-200 (Information Exposure), CWE-441 (Unintended Proxy/Intermediary), and CWE-524 (Uncontrolled Format String), reflecting the credential leakage and confused-deputy aspects of the issue.

Business impact

Applications relying on Service Worker request interception for offline functionality or performance optimization face credential exposure risk. If a public or semi-public route is redirected to an authenticated area (e.g., admin panel, user profile), the Service Worker will silently follow that redirect while preserving cookies and authorization headers, potentially exposing session-restricted data to unintended recipients. This is particularly acute in single-page applications (SPAs) where client-side routing policies are meant to enforce strict security boundaries. The impact is further amplified in multi-tenant or shared-hosting environments where a single application misconfiguration can leak data across security domains.

Affected systems

Angular applications versions 19.x prior to 19.2.23, 20.x prior to 20.3.22, 21.x prior to 21.2.15, and 22.x prior to 22.0.0-rc.2 are affected if they: (1) use the @angular/service-worker package, (2) configure the Service Worker to intercept network requests, and (3) define request policies that restrict redirect behavior (e.g., redirect: 'error'). Organizations running long-term support (LTS) versions or stable releases in production should prioritize upgrading the Angular framework and service-worker package.

Exploitability

Exploitability requires user interaction (UI:R in the CVSS vector), meaning a victim must navigate to or interact with the affected application. The attack is network-accessible (AV:N) and requires no special privileges (PR:N). An attacker cannot directly weaponize this; instead, the vulnerability creates a window for data leakage when the application's routing logic is bypassed by the Service Worker's automatic redirect handling. The CVSS score of 6.1 (Medium) reflects the moderate barrier to exploitation and the requirement for application-specific redirect chains to exist. No public exploit code or active abuse is currently documented.

Remediation

Upgrade Angular and the @angular/service-worker package to patched versions immediately: 22.0.0-rc.2 or later, 21.2.15 or later, 20.3.22 or later, or 19.2.23 or later, depending on your supported version line. Verify the patch version in your node_modules/@angular/service-worker/package.json or lock file after upgrade. For teams unable to upgrade immediately, review and disable Service Worker interception for sensitive routes, or implement server-side redirect validation to reject unexpected redirect destinations.

Patch guidance

1. Update your package.json or use npm/yarn upgrade commands to pull the patched Angular versions. 2. Verify package-lock.json or yarn.lock reflects the new version. 3. Rebuild and test your Service Worker registration and offline behavior to ensure the fix does not break existing functionality. 4. Run your full integration test suite, paying special attention to routes that rely on redirect behavior. 5. For LTS users on version 18 or earlier, contact Angular support to determine patch availability or plan a major version upgrade.

Detection guidance

Review Service Worker configuration in your angular.json (assetGroups, dataGroups) and identify which routes and assets are intercepted. Audit application code for explicit redirect: 'error' or redirect: 'manual' policies in fetch() calls or HttpClient interceptors. Monitor browser console logs and network traffic for unexpected redirects that occur after Service Worker activation. Implement unit and integration tests that verify redirect policies are enforced end-to-end, including through the Service Worker. Check web server logs for redirect chains involving sensitive endpoints.

Why prioritize this

Although the CVSS score is Medium (6.1), this vulnerability warrants prompt attention because: (1) it affects a widely-used development platform used by thousands of organizations, (2) data leakage via credential exposure can result in account takeover or sensitive information disclosure, (3) the vulnerability requires only user interaction and network access—no special conditions—and (4) the fix is available across all supported version lines. Organizations running production Angular applications with Service Workers should treat this as a near-term patch priority.

Risk score, explained

CVSS 6.1 (Medium) reflects a combination of network accessibility (AV:N), low attack complexity (AC:L), and no privilege requirement (PR:N), balanced against the requirement for user interaction (UI:R) and scoped impact (S:C) limited to confidentiality and integrity without availability loss (C:L/I:L/A:N). The score appropriately captures the fact that while the vulnerability is easy to trigger, it depends on specific application routing configurations and user navigation to an affected page. It is not a remote code execution or denial-of-service issue, hence Medium severity rather than High.

Frequently asked questions