CVE-2026-50184: Angular Service Worker Request Security Policy Bypass – Credential Leak & Cache Exposure

Technical summary

The @angular/service-worker package contains a request reconstruction flaw in its helper function that handles intercepted network requests for matched assets. During reconstruction, the function explicitly strips the Request object's credentials configuration (e.g., credentials: 'omit') and cache mode directives (e.g., cache: 'no-store'), reverting them to browser defaults (credentials: 'same-origin' and standard HTTP cache behavior). This causes two security outcomes: (1) credentials are included on outbound requests despite explicit client-side omission directives, enabling potential session leakage; and (2) responses marked as private or non-cacheable are cached by the service worker, persisting sensitive application state in client-side storage beyond the intended session lifetime. The vulnerability stems from CWE-200 (Exposure of Sensitive Information) and CWE-524 (Use of Cache containing Sensitive Information).

Business impact

Organizations deploying Angular applications with Service Workers may expose authenticated session data (cookies, tokens) in network traffic or cache private user pages in persistent local storage. This creates dual risks: active session hijacking if credentials leak across network boundaries, and post-logout information disclosure if cached private state remains accessible. For applications handling PII, health data, or financial information, this could result in compliance violations (GDPR, HIPAA, PCI-DSS) and user trust damage. The impact is user-facing and affects any deployed Angular app relying on Service Worker caching before the fix versions.

Affected systems

Angular versions 19.x prior to 19.2.23, 20.x prior to 20.3.22, 21.x prior to 21.2.15, and 22.0.0-rc.1 and earlier are vulnerable. The @angular/service-worker package is the affected component; applications must explicitly use this package for the vulnerability to manifest. Applications using only core Angular without the service-worker module are not affected. Verify your package.json dependencies and Angular version to confirm exposure.

Exploitability

The vulnerability requires user interaction (UI:R in the CVSS vector) and is limited to network-accessible Angular applications with Service Workers enabled. An attacker cannot directly trigger the flaw; exploitation depends on users accessing the vulnerable application, at which point the Service Worker's default behavior leaks credentials or caches sensitive data. No specialized tools or credentials are required from an attacker perspective—the flaw is inherent to how the Service Worker reconstructs requests. The attack surface is broad (AV:N) but confined to applications that have deployed the vulnerable package.

Remediation

Upgrade the @angular/service-worker package and Angular to one of the patched versions: 22.0.0-rc.2 or later, 21.2.15 or later, 20.3.22 or later, or 19.2.23 or later. After patching, redeploy your application and clear Service Worker caches in affected user browsers (Service Workers may need manual invalidation depending on your update strategy). Verify that your Service Worker configuration correctly specifies credentials and cache policies in your ngsw-config.json; the patch restores these settings but should not require additional code changes if they were correctly specified originally.

Patch guidance

Determine your current Angular version using ng version or by inspecting package.json. If you are on Angular 19, 20, 21, or 22.0-rc, update to the minimum patched version for your major line: 19.2.23+, 20.3.22+, 21.2.15+, or 22.0.0-rc.2+. Use npm/yarn update or update your package.json and reinstall dependencies. Test the updated application in a staging environment to confirm Service Worker behavior and request handling before production deployment. Monitor your application logs for any Service Worker lifecycle events or cache misses during rollout.

Detection guidance

Review your Angular application's dependencies for Service Worker version exposure via package.json or package-lock.json. In a staging environment, enable Service Worker debugging in Chrome DevTools (Application → Service Workers) and inspect network requests to confirm credentials policies are honored post-patch. Audit your ngsw-config.json for intentional credential and cache directives; log or monitor outbound requests to verify that credentials: 'omit' directives result in requests without Authorization headers or cookies. For cached content, inspect browser storage (Application → Cache Storage) to confirm sensitive responses are not persisted.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability directly compromises request-level security controls and session isolation that developers explicitly configured. Session leakage and unintended caching of private data are high-confidence, reproducible outcomes affecting user privacy and authentication integrity. Organizations with Service Workers handling authenticated user data should prioritize patching, particularly if their applications process sensitive or regulated data. The fix is straightforward and low-risk, making rapid deployment feasible.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) and no privilege requirement (PR:N), but requiring user interaction (UI:R) to exploit. The scope is changed (S:C), indicating the vulnerability can affect resources beyond the vulnerable component. Confidentiality and integrity impacts are both low (C:L, I:L) because exposed data is limited to what the user's session can access, and cache modification is constrained to the client side. The score appropriately reflects the practical risk: meaningful but not critical, warranting timely remediation rather than emergency response.

Frequently asked questions