CVE-2026-88059 angular CVE debrief

Who should care

Defenders responsible for Angular applications using Server-Side Rendering (SSR) and hydration should assess exposure and prioritize mitigation. Defenders should prioritize verifying and mitigating this vulnerability in their Angular applications, especially those using Server-Side Rendering (SSR) and hydration.

Why it matters

CVE-2026-88059 is a vulnerability in Angular's HttpTransferCache that can lead to exposure of sensitive data in cached HTML. Defenders should prioritize verifying and mitigating this vulnerability in their Angular applications, especially those using Server-Side Rendering (SSR) and hydration.

• Potential exposure of sensitive data in cached HTML
• Possible unauthorized access to authenticated user data
• Required verification of patch application and configuration
• Necessity to review and update applications using SSR and hydration

Technical summary

The @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in their Angular applications, especially those using Server-Side Rendering (SSR) and hydration.

Recommended defensive actions

• Verify and apply the patches in versions 20.3.28, 21.2.20, and 22.1.1
• Review and update applications using Server-Side Rendering (SSR) and hydration
• Consider attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide details on the vulnerability, including its description, affected versions, and fixed versions. The vulnerability is fixed in versions 20.3.28, 21.2.20, and 22.1.1. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.