3vulnerabilities
- Critical0 (0.0%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate2 (66.7%)
- Low0 (0.0%)
angular-service-worker
Ecosystem: npm
Downloads: 3.48 Mln
- 0CriticalAffects 0 versions
- 1HighAffects 4 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 10 versions
- 0LowAffects 0 versions
Monthly breakdown
- 3 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 2
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting angular-service-worker, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-95qp-cmmw-mgqv | Moderate | @angular/service-worker: Request Credential & Cache Policy StrippingAn issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as `credentials: 'omit'`) and the HTTP `cache` mode configuration (such as `cache: 'no-store'`). These are reverted back to standard browser-default parameters (`cred |
| GitHub (opens in a new tab) | |
| GHSA-gv2q-mqqv-365m | Moderate | Angular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesAn issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as `redirect: 'error'`), falling back to the browser's default `'follow'` strategy. If the target web application makes client-side requests with a strict policy (e.g., exp |
| GitHub (opens in a new tab) | |
| GHSA-qxh6-94w6-9r5p | High | @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerAn information disclosure vulnerability exists in the `@angular/service-worker` package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., `Authorization` tokens, `Proxy-Authorization` credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. ### Impact If an application |
| GitHub (opens in a new tab) |
- GHSA-95qp-cmmw-mgqvModerate@angular/service-worker: Request Credential & Cache Policy Stripping
>= 22.0.0-next.0, < 22.0.0-rc.2>= 21.0.0-next.0, < 21.2.15- +3 more
Affected versions:>= 22.0.0-next.0, < 22.0.0-rc.2>= 21.0.0-next.0, < 21.2.15>= 20.0.0-next.0, < 20.3.22>= 19.0.0-next.0, < 19.2.23<= 18.2.14
An issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as `credentials: 'omit'`) and the HTTP `cache` mode configuration (such as `cache: 'no-store'`). These are reverted back to standard browser-default parameters (`cred
CVE: CVE-2026-50184
- GHSA-gv2q-mqqv-365mModerateAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
>= 22.0.0-next.0, < 22.0.0-rc.2>= 20.0.0-next.0, < 20.3.22- +3 more
Affected versions:>= 22.0.0-next.0, < 22.0.0-rc.2>= 20.0.0-next.0, < 20.3.22>= 19.0.0-next.0, < 19.2.23<= 18.2.14>= 21.0.0-next.0, < 21.2.15
An issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as `redirect: 'error'`), falling back to the browser's default `'follow'` strategy. If the target web application makes client-side requests with a strict policy (e.g., exp
CVE: CVE-2026-50169
- GHSA-qxh6-94w6-9r5pHigh@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
>= 22.0.0-next.0, < 22.0.1>= 21.0.0-next.0, < 21.2.17- +2 more
Affected versions:>= 22.0.0-next.0, < 22.0.1>= 21.0.0-next.0, < 21.2.17>= 20.0.0-next.0, < 20.3.25<= 19.2.25
An information disclosure vulnerability exists in the `@angular/service-worker` package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., `Authorization` tokens, `Proxy-Authorization` credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. ### Impact If an application
CVE: CVE-2026-54264