{"id":"CVE-2026-54264","aliases":["GHSA-qxh6-94w6-9r5p"],"title":"@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker","summary":"@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker","severity":"high","cwe":["CWE-200","CWE-359"],"vendor":"angular","product":"@angular/service-worker","ecosystem":"npm","affected":["@angular/service-worker >= 22.0.0-next.0, < 22.0.1","@angular/service-worker >= 21.0.0-next.0, < 21.2.17","@angular/service-worker >= 20.0.0-next.0, < 20.3.25","@angular/service-worker <= 19.2.25"],"patched":["@angular/service-worker 22.0.1","@angular/service-worker 21.2.17","@angular/service-worker 20.3.25"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-qxh6-94w6-9r5p","references":[{"url":"https://github.com/angular/angular/security/advisories/GHSA-qxh6-94w6-9r5p"},{"url":"https://github.com/angular/angular/pull/69029"},{"url":"https://github.com/angular/angular/commit/47d68dcb26266316647133ab6385e77fc3e5ae08"},{"url":"https://github.com/advisories/GHSA-qxh6-94w6-9r5p"}],"tags":["ghsa","npm"],"epss":0.0039,"epssPercentile":0.32984,"ingestedAt":"2026-07-07T15:41:58.896Z","slug":"CVE-2026-54264","body":"## Overview\n\nAn information disclosure vulnerability exists in the `@angular/service-worker` package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. \n\nThis allows a remote attacker to obtain sensitive credentials (e.g., `Authorization` tokens, `Proxy-Authorization` credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin.\n\n### Impact\nIf an application configured with the Angular Service Worker fetches assets with credential headers (such as `Authorization` header), and one of those requests is redirected to a different origin, the Service Worker will forward those headers to the new origin. This exposes critical credentials and session identifiers to unauthorized third-party servers.\n\n### Attack Preconditions\nFor this vulnerability to be exploitable:\n1. **Vulnerable Configuration:** The application must utilize the `@angular/service-worker` package to fetch assets.\n2. **Credentialed Requests:** The application must attach sensitive request headers (like `Authorization`, `Proxy-Authorization`, or rely on cookies) to asset-group requests.\n3. **Redirect Flow:** These requests must encounter a cross-origin redirect to an attacker-controlled or untrusted domain.\n\n### Patched Versions\n* 22.0.1  \n* 21.2.17  \n* 20.3.25\n\n### Credits\nThis vulnerability was discovered and reported by [CodeMender from Google DeepMind](https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/).\n\n## Affected packages\n\n- `@angular/service-worker >= 22.0.0-next.0, < 22.0.1`\n- `@angular/service-worker >= 21.0.0-next.0, < 21.2.17`\n- `@angular/service-worker >= 20.0.0-next.0, < 20.3.25`\n- `@angular/service-worker <= 19.2.25`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@angular/service-worker 22.0.1`\n- `@angular/service-worker 21.2.17`\n- `@angular/service-worker 20.3.25`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}