Skip to content
Sign in
8.8 High

CVE-2026-68945 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Affected products and versions

Product Affected versions Fixed in
angular 22.0 22.0.0-next.0 → < 22.0.2 22.0.2
angular 21.0 21.0.0-next.0 → < 21.2.19 21.2.19
angular 20.3 earliest → < 20.3.27 20.3.27
common 22.0 22.0.0-next.0 → < 22.0.2 22.0.2
common 21.0 21.0.0-next.0 → < 21.2.19 21.2.19
common 20.3 earliest → < 20.3.27 20.3.27

Other CVEs of angular

The 38 CVEs of angular →
CVE-2026-111753 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) 5.9 Medium CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 8.2 High CVE-2026-111754 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 5.1 Medium CVE-2026-111752 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 8.2 High
Track this CVE