@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

A vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +50 more potentially affected by CVE-2026-50170 via @angular/common (>=21.0.0-next.1, <=21.2.14)

@angular/common NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-50170 Source advisory: OSV:GHSA-Q6F4-QQRG-JV6X...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +34 more potentially affected by CVE-2025-66035 via @angular/common (>=19.0.0-next.9, <=19.2.15)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =0.30.0, =0.30.1 and more Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: OSV:GHSA-58C5-G7WP-6W37...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +34 more potentially affected by CVE-2025-66035 via @angular/common (>=19.0.0-next.9, <=19.2.15)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =0.30.0, =0.30.1 and more Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: GHSA-58C5-G7WP-6W37...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +34 more potentially affected by CVE-2025-66035 via @angular/common (>=19.0.0-next.9, <=19.2.15)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =0.30.0, =0.30.1 and more Source cves: CVE-2025-66035 Source advisory: SNYK:JS-ANGULARCOMMON-14135651...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: SNYK:JS-ANGULARCOMMON-14135651...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: SNYK:JS-ANGULARCOMMON-14135651...

01gind-modulea (>=1.0.0, <=1.2.0), 123testcomp99 (0.0.1) +15617 more potentially affected by CVE-2025-66035 via @angular/common (>=0.0.0-0, <=19.2.15)

@angular/common NPM version =0.0.0-0, =1.0.0, =0.0.32, =0.1.0, =0.0.0, =0.0.1, =1.0.5, =1.0.0, =19.0.0, =0.0.1, =0.0.0, =1.0.1, =1.0.6 and more Source cves: CVE-2025-66035 Source advisory: MEND:CVE-2025-66035...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.0.147-alpha) +23 more potentially affected by CVE-2025-66035 via @angular/common (>=20.0.0-rc.0, <=20.3.12)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.63.3, =0.107.0 and more Source cves: CVE-2025-66035 Source advisory: MEND:CVE-2025-66035...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (>=21.0.0-next.1, <=21.0.0)

@angular/common NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory: MEND:CVE-2025-66035...

@2aminternal/ngx-table-view (>=1.0.1, <=1.0.6), @acaisoft/angular-azure-maps (>=0.0.12, <=1.0.0) +217 more potentially affected by CVE-2021-4231 via @angular/common (>=6.0.0, <=6.1.9)

@angular/common NPM version =6.0.0, =1.0.1, =0.0.12, =1.0.0, =6.0.1, =6.0.0, =9.16.1-rc.0, =1.1.0, =5.0.0-beta.1, =0.0.5, =0.0.1, =0.6.5 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@arsedizioni/ars-utils (>=1.0.0, <=1.0.3), @astick/astick-ng (1.0.0) +271 more potentially affected by CVE-2021-4231 via @angular/common (>=9.0.0, <=9.1.12)

@angular/common NPM version =9.0.0, =1.0.0, =3.0.0, =10.0.7, =1.0.0, =1.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - @datorama/akita-ng-entity-service 2.0.2 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@acaisoft/angular-azure-maps (>=0.0.3, <=0.0.11), @afelio/sprb-osiris-uikit (1.0.48) +380 more potentially affected by CVE-2021-4231 via @angular/common (>=5.0.0, <=5.2.10)

@angular/common NPM version =5.0.0, =0.0.3, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.2, =1.0.0-beta.1, =0.1.15, =1.0.0, =1.0.0-alpha.55,...

@altariotechnologieslisbon/seed-pro (>=0.0.1, <=0.1.0), @bi8/am-data-table (>=8.0.0, <=8.0.2) +475 more potentially affected by CVE-2021-4231 via @angular/common (>=8.0.0, <=8.2.13)

@angular/common NPM version =8.0.0, =0.0.1, =8.0.0, =8.0.0, =1.0.0, =1005.9.0, =8.0.2, =7.0.0-internal-20190531-1650, =1.0.6, =1.0.30 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +536 more potentially affected by CVE-2021-4231 via @angular/common (>=4.0.0, <=4.4.6)

@angular/common NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =2.8.2, =3.0.0-beta.45, =1.32.0-SNAPSHOT.20171018190510, =1.0.0, =0.0.64, =1.10.0, =2.0.0-rc.2, =1.10.1, =2.0.0-beta.8, =1.0.1, =0.2.1, =0.3.4 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@abt-desk/apm (>=0.0.1, <=0.33.12), @abt-desk/rsc (>=0.1.3, <=0.1.124) +473 more potentially affected by CVE-2021-4231 via @angular/common (>=7.0.0, <=7.2.14)

@angular/common NPM version =7.0.0, =0.0.1, =0.1.3, =1.0.0, =2.0.0, =9.25.1, =1.0.2-1.beta.1, =1.0.20, =0.0.1, =0.0.1, =0.1.0 - @ekkuluri/sharedmodule 0.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...