p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de @angular/service-worker

Vulnérabilités publiées pour @angular/service-worker au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3

  1. CVE-2026-50184

    Moyenne · CVSS 5.7EPSS 0,21%Correctif disponible

    Angular: Request Credential & Cache Policy Stripping in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Mettez à jour vers 19.2.23
    • Mettez à jour vers 20.3.22
    • Mettez à jour vers 21.2.15
    • Mettez à jour vers 22.0.0-rc.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-50169

    Moyenne · CVSS 5.7EPSS 0,23%Correctif disponible

    Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the br

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Mettez à jour vers 19.2.23
    • Mettez à jour vers 20.3.22
    • Mettez à jour vers 21.2.15
    • Mettez à jour vers 22.0.0-rc.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-54264

    Élevée · CVSS 8.3EPSS 0,39%Correctif disponible

    Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or sess

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Mettez à jour vers 20.3.25
    • Mettez à jour vers 21.2.17
    • Mettez à jour vers 22.0.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →