Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-50170 · CVE overview and exploitation status

EUVD-2026-38292

GHSA-q6f4-qqrg-jv6x

cve-program · CVE-2026-50170

• https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x
• https://github.com/angular/angular/pull/67964

euvd · EUVD-2026-38292

• https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x
• https://github.com/angular/angular/pull/67964

nvd · CVE-2026-50170

• https://github.com/angular/angular/pull/67964
• https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x

osv · GHSA-q6f4-qqrg-jv6x

• https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x
• https://nvd.nist.gov/vuln/detail/CVE-2026-50170
• https://github.com/angular/angular/pull/67964
• https://github.com/angular/angular

• Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when … · Advisory content revised · 15 Nov 2026