CVE-2026-54266 (High) detected in common-12.2.5.tgz

[mend-for-github-com]

CVE-2026-54266 - High Severity Vulnerability

Vulnerable Library - common-12.2.5.tgz

Angular - commonly needed directives and services

Library home page: https://registry.npmjs.org/@⁠angular/common/-/common-12.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ common-12.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 36a9c5d28529109984de6fcc3d0a157d561dac4a

Found in base branch: master

Vulnerability Details

Angular's "HttpTransferCache" caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in "TransferState" using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters). The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, allowing attackers to find hash collisions. An attacker can easily find a query parameter string (e.g., "q=aaCAZMMM" for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., "/api/user/profile"). When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the "TransferState" cache. Impact When the application attempts to retrieve the cached response for the sensitive endpoint (such as the user's profile), it receives the attacker-controlled response instead. This results in: * State Poisoning: The application runs with attacker-forged data, which can lead to bypassing client-side security controls or DOM-based Cross-Site Scripting (XSS) if the data is rendered unsafely. * Information Leakage: If the sensitive response is mistakenly associated with the attacker's search results and rendered on the page, the victim's sensitive data may be disclosed to the attacker. Patched Versions * 22.0.1 * 21.2.17 * 20.3.25 Framework-Level Fix The logic has been updated to use a cryptographically secure SHA-256 hash algorithm for generating "TransferState" cache keys in "HttpTransferCache". The cache keys are now 256-bit hexadecimal strings. Workarounds If you cannot upgrade immediately, configure your "HttpClient" requests to skip transfer caching for sensitive endpoints: this.http.get('/api/user/profile', { transferCache: false }); Alternatively, disable the HTTP transfer cache globally in your application bootstrap config: import { provideClientHydration, withNoHttpTransferCache } from '@⁠angular/platform-browser'; export const appConfig = { providers: [ provideClientHydration( withNoHttpTransferCache() ) ] }; Credits This vulnerability was discovered and reported by "CodeMender from Google DeepMind" (https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/).

Publish Date: 2026-06-15

URL: CVE-2026-54266

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-39pv-4j6c-2g6v

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v20.3.25,https://github.com/angular/angular.git - v21.2.17

---

• Check this box to open an automated fix PR