CVE-2026-54266: Angular HttpTransferCache Hash Collision Vulnerability

Technical summary

Angular's HttpTransferCache hashes request properties—method, response type, mapped URL, serialized body, and query parameters—using a 32-bit DJB2-like polynomial rolling hash to generate cache keys stored in TransferState. The hash space is cryptographically weak and vulnerable to precomputed collisions. An attacker can discover a query parameter string that collides with the hash of a sensitive endpoint, causing the SSR process to execute both requests but store the colliding response in the cache, overwriting the intended one. The vulnerability affects Angular versions prior to 22.0.1, 21.2.17, and 20.3.25.

Business impact

Applications using Angular SSR could serve incorrect cached responses to users, potentially exposing sensitive data or returning stale search results instead of profile information. This is especially damaging if the sensitive endpoint contains personal, financial, or authentication-related data. An attacker needs only to craft a URL and social engineer a victim into clicking it; no special access is required. The impact is confidentiality and integrity of cached HTTP responses during the critical hydration phase.

Affected systems

Angular applications using server-side rendering (SSR) with HttpTransferCache are affected. Specifically: Angular 20.x versions prior to 20.3.25, Angular 21.x versions prior to 21.2.17, and Angular 22.x versions prior to 22.0.1. Applications that do not use SSR or do not rely on HttpTransferCache for caching responses are not impacted.

Exploitability

Exploitation is straightforward: an attacker discovers a hash collision offline, crafts a malicious URL containing the colliding query parameter, and tricks a user into visiting it. No authentication, special privileges, or active network positioning are required. The attack relies only on user interaction (clicking a link), making it practical for phishing or watering hole campaigns. The 32-bit hash space is small enough that collisions can be found with modest computational effort.

Remediation

Upgrade to Angular 22.0.1, 21.2.17, or 20.3.25 or later, which replace the weak 32-bit hash with a stronger hashing algorithm for cache key generation. Organizations should prioritize patching applications that expose sensitive user endpoints or handle confidential data via SSR.

Patch guidance

Review your Angular version against the affected ranges: pre-20.3.25, pre-21.2.17, and pre-22.0.1. If your application uses SSR, upgrade to the patched version in your version line. Test thoroughly in a staging environment to ensure hydration and caching behavior remains correct after patching. For teams unable to upgrade immediately, consider disabling HttpTransferCache for sensitive endpoints as a temporary mitigation, though this degrades performance.

Detection guidance

Monitor for hash collision attempts by logging cache hits that involve requests to different endpoints producing identical cache keys. Review application logs and TransferState behavior during SSR for anomalies such as unexpected response data serving. In the client-side application, audit any cases where cached responses appear mismatched to the request that prompted them. Network-level detection is difficult without deep inspection of query parameters and hashes.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability should be prioritized if your application (1) uses Angular SSR, (2) handles sensitive user data via HTTP endpoints, (3) allows any user-controlled query parameters, or (4) is publicly accessible. The attack surface is broad because victims need only click a link, and hash collisions are precomputable. Applications with lower-sensitivity data or those not using SSR can deprioritize.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects low attack complexity (AC:L) and no special privileges required (PR:N), balanced against user interaction (UI:R) and limited scope change (S:C) with only partial confidentiality and integrity impact (C:L/I:L) and no availability loss. The score appropriately captures the practical threat: while exploitation is easy and requires only a phishing vector, the impact is confined to cached response poisoning rather than system compromise or mass data exposure.

Frequently asked questions