---
id: CVE-2026-50169
aliases:
  - GHSA-gv2q-mqqv-365m
title: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
summary: Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
severity: medium
cwe:
  - CWE-200
  - CWE-441
  - CWE-524
vendor: angular
product: '@angular/service-worker'
ecosystem: npm
affected:
  - '@angular/service-worker >= 22.0.0-next.0, < 22.0.0-rc.2'
  - '@angular/service-worker >= 20.0.0-next.0, < 20.3.22'
  - '@angular/service-worker >= 19.0.0-next.0, < 19.2.23'
  - '@angular/service-worker <= 18.2.14'
  - '@angular/service-worker >= 21.0.0-next.0, < 21.2.15'
patched:
  - '@angular/service-worker 22.0.0-rc.2'
  - '@angular/service-worker 20.3.22'
  - '@angular/service-worker 19.2.23'
  - '@angular/service-worker 21.2.15'
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-gv2q-mqqv-365m'
references:
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-gv2q-mqqv-365m'
  - url: 'https://github.com/angular/angular/pull/67494'
  - url: 'https://github.com/advisories/GHSA-gv2q-mqqv-365m'
tags:
  - ghsa
  - npm
epss: 0.00228
epssPercentile: 0.13796
ingestedAt: '2026-07-07T15:41:58.958Z'
---

## Overview

An issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function. 

During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as `redirect: 'error'`), falling back to the browser's default `'follow'` strategy.

If the target web application makes client-side requests with a strict policy (e.g., expecting a network error instead of automatically following redirects), the service worker will bypass this instruction and automatically follow HTTP 3xx redirects to other destinations. This acts as an unintended proxy/intermediary ("Confused Deputy") and can result in cookie/credential exposure or same-origin session-restricted data leakage if public dynamic routes redirect to sensitive routes.

### Impact
Web applications registering the `@angular/service-worker` package are vulnerable to this redirect-policy bypass if they make safe client-side fetch calls (such as `{ redirect: 'error' }`) to paths matched by a service worker asset group (such as lazy-loaded JavaScript bundles or dynamic public assets) that can return HTTP redirects to authenticated same-origin secure endpoints. 

By stripping developer-defined safety boundaries, the service worker allows the browser to transparently query and return data from credentials-guarded resources that should have been blocked at the network barrier.

### Attack Preconditions
To successfully exploit this vulnerability, all of the following application states and parameters must concurrently exist:
1. **Active Angular Service Worker:** The target application uses `@angular/service-worker` and has an active registration of `ngsw-worker.js` inside the client's browser context.
2. **Asset Group Matching:** An `assetGroups` pattern in `ngsw-config.json` encompasses the target dynamic routing endpoint.
3. **Same-Origin Dynamic Redirection:** The server routes a public matched asset route to a service that returns an HTTP 3xx redirect pointing to a sensitive, session-restricted same-origin private route (e.g., `/private/account-summary.json`).
4. **Established User Session:** The victim user currently has an active authentication state, such as valid same-origin session cookies or auth headers stored by the browser.
5. **Client-Side Safe Fetch Call:** The application initiates an explicit fetch request to the route with safety parameters: `{ redirect: 'error' }`.

### Mitigations & Workarounds
If upgrading the `@angular/service-worker` package is not immediately feasible, developers should implement the following defensive measures:
* **Avoid Public-to-Private Dynamic Redirection:** Refactor the server architecture so that public paths matched by service worker asset groups never issue HTTP 3xx redirects to authenticated same-origin secure endpoints.
* **Strict Cookie Configuration:** Apply strict flags to session cookies (`SameSite=Strict; Secure; HttpOnly`) and consider explicit route isolations (such as subdomains) for credential-guarded private resources.
* **Exclude Secure Endpoints from SW Config:** Verify your `ngsw-config.json` settings and ensure that patterns targeting dynamic, secure endpoints are explicitly excluded from automatic asset groups or caching scopes.

### Patches
- 22.0.0-rc.2
- 21.2.15
- 20.3.22
- 19.2.23

## Affected packages

- `@angular/service-worker >= 22.0.0-next.0, < 22.0.0-rc.2`
- `@angular/service-worker >= 20.0.0-next.0, < 20.3.22`
- `@angular/service-worker >= 19.0.0-next.0, < 19.2.23`
- `@angular/service-worker <= 18.2.14`
- `@angular/service-worker >= 21.0.0-next.0, < 21.2.15`

## Remediation

Upgrade to a patched release:

- `@angular/service-worker 22.0.0-rc.2`
- `@angular/service-worker 20.3.22`
- `@angular/service-worker 19.2.23`
- `@angular/service-worker 21.2.15`