p PatchFirst

PatchFirst · Latest vulnerabilities

@angular/service-worker vulnerabilities

Vulnerabilities published for @angular/service-worker in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-50184

    Medium · CVSS 5.7EPSS 0.21%Fix available

    Angular: Request Credential & Cache Policy Stripping in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-50169

    Medium · CVSS 5.7EPSS 0.23%Fix available

    Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the br

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-54264

    High · CVSS 8.3EPSS 0.39%Fix available

    Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or sess

    @angular/service-worker @angular/service-worker @angular/service-worker @angular/service-workerNode.js
    • Update to 20.3.25
    • Update to 21.2.17
    • Update to 22.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →