p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @angular/service-worker

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @angular/service-worker: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2026-50184

    Mittel · CVSS 5.7EPSS 0,21%Korrektur verfügbar

    Angular: Request Credential & Cache Policy Stripping in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Auf 19.2.23 aktualisieren
    • Auf 20.3.22 aktualisieren
    • Auf 21.2.15 aktualisieren
    • Auf 22.0.0-rc.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-50169

    Mittel · CVSS 5.7EPSS 0,23%Korrektur verfügbar

    Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the br

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Auf 19.2.23 aktualisieren
    • Auf 20.3.22 aktualisieren
    • Auf 21.2.15 aktualisieren
    • Auf 22.0.0-rc.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-54264

    Hoch · CVSS 8.3EPSS 0,39%Korrektur verfügbar

    Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or sess

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Auf 20.3.25 aktualisieren
    • Auf 21.2.17 aktualisieren
    • Auf 22.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →