Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-54266 · CVE overview and exploitation status

EUVD-2026-38269

GHSA-39pv-4j6c-2g6v

cve-program · CVE-2026-54266

• https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v
• https://github.com/angular/angular/pull/69153
• https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133

euvd · EUVD-2026-38269

• https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v
• https://github.com/angular/angular/pull/69153
• https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133

nvd · CVE-2026-54266

• https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133
• https://github.com/angular/angular/pull/69153
• https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v

osv · GHSA-39pv-4j6c-2g6v

• https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v
• https://nvd.nist.gov/vuln/detail/CVE-2026-54266
• https://github.com/angular/angular/pull/69153
• https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133
• https://github.com/angular/angular

• Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angular's HttpTransferCache caches HTTP requests made during Server-S… · Advisory content revised · 15 Nov 2026