chore(deps): update dependency @angular/common to v22.1.1 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	22.0.2 → 22.1.1

---

Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent

CVE-2026-88059 / GHSA-p297-fm68-3q8c

More information

Details

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent().

The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState (serialized as JSON in <script id="ng-state">). Following the remediation of CVE-2026-50170, HttpTransferCache automatically skips caching requests that contain authentication headers or credentials (Authorization, Cookie, withCredentials, etc.).

However, when a child HttpClient delegates to a parent client via withRequestsMadeViaParent(), the child's TransferCache interceptor evaluates whether the request is eligible for caching before delegating to the parent client's interceptor chain.

If an outgoing request originates as anonymous from the child client, the child TransferCache marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an Authorization header or API token), the parent TransferCache correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child TransferCache still stores the response in TransferState based on its initial pre-delegation evaluation.

Impact

Successful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when:

1. During SSR, a child HttpClient initiates an unauthenticated request that is subsequently authenticated by a parent interceptor.
2. The authenticated response body is cached into the SSR-rendered HTML page (TransferState).
3. The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions.
4. Subsequent visitors requesting the same page receive the cached HTML containing the previous user's private data.

Attack Preconditions & Vulnerable Configurations

An application is affected only if all of the following conditions are met:

• SSR and Hydration Enabled: The application uses Server-Side Rendering with hydration enabled (e.g., via provideClientHydration()).
• Hierarchical HttpClient with Delegation: The application configures a child HttpClient using withRequestsMadeViaParent().
• Parent-Level Authentication Injection: Authentication credentials (such as Authorization headers, session cookies, or custom API tokens filtered via withHttpTransferCacheOptions) are attached by an interceptor in the parent injector chain rather than on the initial child request.
• Shared HTML Caching: The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache).

Vulnerable Code Pattern Example

// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
  providers: [
    provideHttpClient(
      // Parent interceptor attaches sensitive Authorization header
      withInterceptors([
        (req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
      ])
    ),
  ],
};

// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
  [
    // Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
    provideHttpClient(withRequestsMadeViaParent()),
  ],
  parentInjector
).get(HttpClient);

// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();

Patches

The issue is resolved by updating @angular/common to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring HttpTransferCache evaluates cache eligibility after parent request interceptors run.

• 22.1.1
• 21.2.20
• 20.3.28

Workarounds & Mitigations

For applications that cannot immediately upgrade to a patched version, use one of the following mitigations:

1. Attach Credentials Before or Within the Child Client: Ensure authentication headers (e.g., Authorization) are attached directly when constructing the request or via an interceptor configured directly on the child HttpClient, rather than relying solely on parent interceptors.
2. Apply Explicit Cache Filters on the Child Client: Configure withHttpTransferCacheOptions with a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data:

   provideClientHydration(
     withHttpTransferCacheOptions({
       filter: (req) => !req.url.includes('/api/private/'),
     })
   )

3. Disable HTTP Transfer Cache for Sensitive Routes: If specific SSR routes handle user-authenticated data, disable transfer caching for those requests or ensure the SSR response sets Cache-Control: no-store / private headers at your edge/CDN layer so personalized HTML is never shared.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c
• https://github.com/angular/angular/issues/69777
• https://github.com/angular/angular/pull/69778
• https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af
• https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d
• https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56
• https://github.com/angular/angular/releases/tag/v20.3.28
• https://github.com/angular/angular/releases/tag/v21.2.20
• https://github.com/angular/angular/releases/tag/v22.1.1
• https://github.com/advisories/GHSA-p297-fm68-3q8c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v22.1.1

Compare Source

core

Commit	Type	Description
aa6d3189c1	fix	initialize hydration triggers after late runtime activation
deecb301c8	fix	warn when style property bindings receive invalid values

http

Commit	Type	Description
ac3728e79f	fix	avoid aborting completed requests in FetchBackend
688a0a7118	fix	respect content-type charset in fetch backend text decoder
a13b968451	fix	run root interceptors in the terminal request chain
32af9b525e	fix	strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

v22.1.0

Compare Source

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#​69017)

compiler

Commit	Type	Description
af5e4e1131	feat	Add an error for --global-foo cases (#​68846)
d579ecaf73	feat	Disable '--global-' error outside of g3 (#​68846)
f98547675c	feat	Namespace CSS variables to the app (#​68846)
8c8b2f7783	feat	Support css var namespacing in properties (#​68846)
292199aa4d	fix	permissive whitespace parsing in default never blocks
25c744c4d0	fix	support foreign components defined outside top-level scope
5bd00add07	fix	support foreign components inside control flow blocks (#​69674)
2e442f7876	perf	do not emit tag name when control flow root is foreign component (#​69674)

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#​68674)

core

Commit	Type	Description
124ba10ead	feat	add custom set option to linkedSignal
eab4847a8b	feat	Adds deep linking from Performance panel to DevTools
091456a214	fix	account for namespaces in host binding sanitization (#​69558)
b3748e9fe4	fix	correct container anchor collection order to match DOM layout
11b206b919	fix	introduce disposal mechanism for Angular views in foreign @content
56607967db	fix	introduce logical-only containers for foreign content
23cf1a828b	fix	sanitize host bindings on concrete hosts (#​69558)
0c07356c5c	fix	set current tnode in foreign component instruction on reuse

forms

Commit	Type	Description
bbbd357bd2	fix	add utility to assert that value is a field tree

http

Commit	Type	Description
e3630c23c5	feat	add options to allow caching of credentialed and non-cacheable HTTP requests
ec16a3d6c6	fix	enable xsrf for root-provided HttpClient
39e362eea5	fix	match header values exactly when deleting
be46ca8696	fix	preserve immutability of materialized clones
c0cbd46bd7	fix	skip transfer cache for fetch credentialed requests (#​69017)
af04e266cc	refactor	deprecate jsonp support

language-service

Commit	Type	Description
7f0265e43a	feat	compile non-exported classes if standalone (#​68454)
4f9c824dd9	feat	Typecheck templates which would require inline typecheck blocks (#​68454)
a99fb915c0	fix	account for strictTemplates being enabled by default

migrations

Commit	Type	Description
c75ff0255c	feat	add migration from injectable to service
5d5b2ea72d	fix	correctly detect then/else keywords in control flow migration

platform-server

Commit	Type	Description
cf9d7fa0f8	fix	harden platform location origin validation during SSR (#​69184)

router

Commit	Type	Description
97a3fd6a55	feat	handle null and undefined inputs in RouterLinkActive

v22.0.8

Compare Source

common

Commit	Type	Description
c0368f2278	fix	preserve crossorigin on image preloads

core

Commit	Type	Description
8616ba9db6	fix	ensure SVG animation attributeName is checked case-insensitively

forms

Commit	Type	Description
d302c7ab83	fix	ensure pending status propagates to the root form in signal forms

http

Commit	Type	Description
9d40f8aefe	fix	prevent transfer cache key collisions

migrations

Commit	Type	Description
388daea2fc	fix	correctly migrate ngClass with mixed space-separated keys
bb39cda648	fix	preserve NgClass import on partial migration

v22.0.7

Compare Source

common

Commit	Type	Description
91e33aa1de	fix	avoid prototype lookups in date format caches

compiler

Commit	Type	Description
5b516e3a58	fix	parsing of an empty template literal interpolation

compiler-cli

Commit	Type	Description
c88ddde1c9	fix	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Type	Description
94d9591b51	fix	allow static attributes for explicit input transforms
c89f71a74c	fix	ignore processing instruction syntax in templates
70500e4067	fix	preserve explicit input transform write type

forms

Commit	Type	Description
1b9964675f	fix	allow multiple async validators
64d6d47a0c	fix	preserve intermediate number values in signal forms
6cf7446afa	fix	prevent stale CVA writeback during debounce

http

Commit	Type	Description
20b7dc3023	fix	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Type	Description
22d5a091d1	fix	build runtime translations map with a null prototype
8ce1fcf7fa	fix	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Type	Description
b34bf0dce8	fix	prevent ReDoS in SOURCEMAP_URL_REGEXP

v22.0.6

Compare Source

compiler

Commit	Type	Description
fd4ddcafed	fix	use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit	Type	Description
534fe81a89	fix	apply debugName transform to required signal queries
3b08201bfb	fix	detect uninvoked signals in bound expressions using ternary

forms/signals

Commit	Type	Description
171669f7b2	fix	make extractValue reactive for compat AbstractControl values

migrations

Commit	Type	Description
0a6af1496b	fix	preserve transitive NgModule references when pruning
d4a926a762	fix	remove stale model import in model-output migration

router

Commit	Type	Description
c238bd2ad7	fix	handle outlet named proto in segment group maps
8e6d7f7190	fix	use safe hasOwnProperty when parsing query params

v22.0.5

Compare Source

common

Commit	Type	Description
eb8fb9fe58	fix	use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit	Type	Description
baf09a9939	fix	include toSignal in debugName transform

core

Commit	Type	Description
e598dc843f	fix	improve input writes migration in best effort mode
ced0180b06	fix	reject dynamic script host elements

router

Commit	Type	Description
ca13b42e7c	fix	fix malformed jsdoc comment for RouterLinkWithHref export

v22.0.4

Compare Source

migrations

Commit	Type	Description
fd37f09f37	fix	resolve migration failure when tsconfig specifies rootDir

v22.0.3

Compare Source

compiler

Commit	Type	Description
f90c20df40	fix	account for NgModule dependencies in JIT-compiled partial declarations
f4f7f3755c	fix	remove unused import breaking CI in 22.0.x

compiler-cli

Commit	Type	Description
06d854929c	fix	report diagnostic instead of crashing on malformed host binding

core

Commit	Type	Description
2799304259	fix	avoid uncaught promise errors in injectAsync prefetching

http

Commit	Type	Description
8cdc202dfc	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
b4a5a2fb4e	fix	preserve referrer in asset requests
a16f9b2263	fix	preserve referrer policy in asset requests

upgrade

Commit	Type	Description
bcc648f4b6	fix	support model() signals in downgradeComponent

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.