| Package | Affected versions | Patched versions |
|---|---|---|
| angular | = 22.0.0≥ 19.0.0, < 19.2.23≥ 20.0.0, < 20.3.22≥ 21.0.0, < 21.2.15≤ 18.2.14 | 19.2.2320.3.2221.2.15 |
| @angular/service-worker | ≥ 19.0.0-next.0, < 19.2.23≥ 20.0.0-next.0, < 20.3.22≥ 21.0.0-next.0, < 21.2.15≥ 22.0.0-next.0, < 22.0.0-rc.2≤ 18.2.14 | 19.2.2320.3.2221.2.1522.0.0-rc.2 |
An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function.
During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties).
This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout.
Web applications registering the @angular/service-worker package are vulnerable to credential exposure or post-logout cache persistence if client-side code relies on fetch calls with explicit safety attributes (such as { credentials: 'omit' } or { cache: 'no-store' }) targeting paths matched by service worker asset groups.
By stripping these safety boundaries, the service worker exposes same-origin cookies and dynamic sensitive data to endpoints that should not receive them, or retains dynamic user sessions in cache storage where logout operations fail to fully evict user records.
To successfully exploit this vulnerability, all of the following application states and parameters must concurrently exist:
@angular/service-worker and has an active registration of ngsw-worker.js inside the client's browser context.assetGroups pattern in ngsw-config.json encompasses the target dynamic routing endpoint.{ credentials: 'omit' } or specific cache control parameters (e.g. { cache: 'no-store' }).If upgrading the @angular/service-worker package is not immediately feasible, developers should implement the following defensive measures:
SameSite=Strict; Secure; HttpOnly) and ensure complete route isolation for credential-guarded secure resources.ngsw-config.json.if ('caches' in window) {
caches.keys().then(names => {
for (let name of names) {
if (name.startsWith('ngsw:')) {
caches.delete(name);
}
}
});
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free