p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de @angular/service-worker

Vulnerabilidades publicadas para @angular/service-worker en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 3

  1. CVE-2026-50184

    Media · CVSS 5.7EPSS 0,21%Corrección disponible

    Angular: Request Credential & Cache Policy Stripping in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Actualiza a 19.2.23
    • Actualiza a 20.3.22
    • Actualiza a 21.2.15
    • Actualiza a 22.0.0-rc.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-50169

    Media · CVSS 5.7EPSS 0,23%Corrección disponible

    Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the br

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Actualiza a 19.2.23
    • Actualiza a 20.3.22
    • Actualiza a 21.2.15
    • Actualiza a 22.0.0-rc.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-54264

    Alta · CVSS 8.3EPSS 0,39%Corrección disponible

    Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or sess

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Actualiza a 20.3.25
    • Actualiza a 21.2.17
    • Actualiza a 22.0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →