[deps]: Update @angular/common to v21.2.20 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	21.2.17 → 21.2.20

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

CVE-2026-68945 / GHSA-jhpw-976m-542j

More information

Details

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.

During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

Impact

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

• State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
• Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Patched Versions

• 22.0.2
• 21.2.19
• 20.3.27

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:

this.http.get('/api/resource', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j
• https://github.com/angular/angular/pull/68571
• https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
• https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
• https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
• https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
• https://github.com/advisories/GHSA-jhpw-976m-542j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent

CVE-2026-88059 / GHSA-p297-fm68-3q8c

More information

Details

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent().

The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState (serialized as JSON in <script id="ng-state">). Following the remediation of CVE-2026-50170, HttpTransferCache automatically skips caching requests that contain authentication headers or credentials (Authorization, Cookie, withCredentials, etc.).

However, when a child HttpClient delegates to a parent client via withRequestsMadeViaParent(), the child's TransferCache interceptor evaluates whether the request is eligible for caching before delegating to the parent client's interceptor chain.

If an outgoing request originates as anonymous from the child client, the child TransferCache marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an Authorization header or API token), the parent TransferCache correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child TransferCache still stores the response in TransferState based on its initial pre-delegation evaluation.

Impact

Successful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when:

1. During SSR, a child HttpClient initiates an unauthenticated request that is subsequently authenticated by a parent interceptor.
2. The authenticated response body is cached into the SSR-rendered HTML page (TransferState).
3. The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions.
4. Subsequent visitors requesting the same page receive the cached HTML containing the previous user's private data.

Attack Preconditions & Vulnerable Configurations

An application is affected only if all of the following conditions are met:

• SSR and Hydration Enabled: The application uses Server-Side Rendering with hydration enabled (e.g., via provideClientHydration()).
• Hierarchical HttpClient with Delegation: The application configures a child HttpClient using withRequestsMadeViaParent().
• Parent-Level Authentication Injection: Authentication credentials (such as Authorization headers, session cookies, or custom API tokens filtered via withHttpTransferCacheOptions) are attached by an interceptor in the parent injector chain rather than on the initial child request.
• Shared HTML Caching: The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache).

Vulnerable Code Pattern Example

// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
  providers: [
    provideHttpClient(
      // Parent interceptor attaches sensitive Authorization header
      withInterceptors([
        (req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
      ])
    ),
  ],
};

// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
  [
    // Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
    provideHttpClient(withRequestsMadeViaParent()),
  ],
  parentInjector
).get(HttpClient);

// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();

Patches

The issue is resolved by updating @angular/common to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring HttpTransferCache evaluates cache eligibility after parent request interceptors run.

• 22.1.1
• 21.2.20
• 20.3.28

Workarounds & Mitigations

For applications that cannot immediately upgrade to a patched version, use one of the following mitigations:

1. Attach Credentials Before or Within the Child Client: Ensure authentication headers (e.g., Authorization) are attached directly when constructing the request or via an interceptor configured directly on the child HttpClient, rather than relying solely on parent interceptors.
2. Apply Explicit Cache Filters on the Child Client: Configure withHttpTransferCacheOptions with a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data:

   provideClientHydration(
     withHttpTransferCacheOptions({
       filter: (req) => !req.url.includes('/api/private/'),
     })
   )

3. Disable HTTP Transfer Cache for Sensitive Routes: If specific SSR routes handle user-authenticated data, disable transfer caching for those requests or ensure the SSR response sets Cache-Control: no-store / private headers at your edge/CDN layer so personalized HTML is never shared.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c
• https://github.com/angular/angular/issues/69777
• https://github.com/angular/angular/pull/69778
• https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af
• https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d
• https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56
• https://github.com/angular/angular/releases/tag/v20.3.28
• https://github.com/angular/angular/releases/tag/v21.2.20
• https://github.com/angular/angular/releases/tag/v22.1.1
• https://github.com/advisories/GHSA-p297-fm68-3q8c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v21.2.20

Compare Source

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

v21.2.19

Compare Source

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

v21.2.18

Compare Source

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: ui/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @bitwarden/splunk-ui@1.0.0
npm error Found: @angular/core@21.2.17
npm error node_modules/@angular/core
npm error   @angular/core@"21.2.17" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/core@"21.2.20" from @angular/common@21.2.20
npm error node_modules/@angular/common
npm error   @angular/common@"21.2.20" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-13T13_49_32_472Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-13T13_49_32_472Z-debug-0.log