Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During thi...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

Use of Cache Containing Sensitive Information

Overview @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session-restricted data or expose credentials by exploiting...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@agilie/widget-template (>=1.0.6, <=1.1.6), @eui/deps-base (>=18.0.0-next.1, <=18.2.20) +9 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=18.0.0, <=18.2.14)

@angular/service-worker NPM version =18.0.0, =1.0.6, =18.0.0-next.1, =18.0.0-next.1, =1.0.0, =12.0.0, =0.0.1, =1.0.0, =18.0.1, =0.0.1, =0.0.26 - ng-x-rocket 1.0.0 - table-collection-library 0.0.0 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) potentially affected by CVE-2026-50169 via @angular/service-worker (>=21.0.0, <=21.2.11)

@angular/service-worker NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

GHSA-GV2Q-MQQV-365M Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During thi...

Moderate: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2026-49560

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 Description An issue in the @angular/service-worker package compromises the integrity of request-policy...

PT-2026-49563

Name of the Vulnerable Software and Affected Versions @angular/service-worker versions prior to 19.2.23 @angular/service-worker versions prior to 20.3.22 @angular/service-worker versions prior to 21.2.15 @angular/service-worker versions prior to 22.0.0-rc.2 Description An issue in the...

PT-2026-49580

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description An information disclosure issue exists in the @angular/service-worker package. When the Service Worker fetches assets, it preserve...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:25999)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:25999 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and...

CVE-2026-39463: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

PT-2026-49374

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

ALSA-2026:25999 Moderate: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

Malicious code in vite-plugin-compress-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f7b2710441863a429a2a1833e06f54e9afc23c87d1b40d7ee09e1995c6a65c2 On module load, this Vite plugin performs an HTTP GET to https://www.jsonkeeper.com/b/XVHGD an anonymous, mutable paste host and passes the response'...

EUVD-2026-32606

Budibase: Unanchored Regex in matchers.ts Allows CSRF Bypass via Query String Injection in Budibase Worker...

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

Summary The buildMatcherRegex / matches functions in packages/backend-core/src/middleware/matchers.ts share the same structural root cause as the recently patched CVE-2026-31816: route patterns are compiled into unanchored regular expressions and tested against ctx.request.url, which includes the...