CVE-2026-88059— Angular 使用 withRequestsMadeViaParent 时信息泄露漏洞
一分钟漏洞结论
影响对象
angular angular
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Angular 是一个用于使用 TypeScript/JavaScript 及其他语言构建移动端和桌面端 Web 应用的开发平台。 在 20.3.28、21.2.20 和 22.1.1 之前，Angular 的 中的 可能在特定条件下缓存经过身份验证的响应。该问题发生在同时启用服务端渲染（SSR）和水合（hydration），且使用通过 配置的分层 时。 具体场景如下： 1. 子级 TransferCache 在委派请求之前，先评估了一个初始的匿名请求。 2. 随后，父级的 拦截器链为请求添加了 Authoriza
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-88059 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
来源: CVE Program / CVE List V5
Vulnerability Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
信息暴露
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-88059 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-88059 的情报信息
请登录查看更多情报信息。
CVE-2026-88059 其他参考 (9)
-
https://github.com/angular/angular/pull/69778 x_refsource_MISC
-
https://github.com/angular/angular/issues/69777 x_refsource_MISC
-
https://github.com/angular/angular/releases/tag/v22.1.1 x_refsource_MISC
-
🔗 Release 21.2.20 · angular/angular · GitHub x_refsource_MISC
-
🔗 Release 20.3.28 · angular/angular · GitHub x_refsource_MISC
-
https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c x_refsource_CONFIRM
同批安全公告 · angular · 2026-09-10 · 共 5 条
| CVE-2026-88058 | 8.6 HIGH | Angular 服务器端渲染SSR 跨站脚本漏洞 |
| CVE-2026-88056 | 8.6 HIGH | Angular SSR 服务端请求伪造及凭证泄露 |
| CVE-2026-88060 | 8.6 HIGH | Angular SSR 跨文档边界模板内容XSS漏洞 |
| CVE-2026-88057 | 5.3 MEDIUM | Angular core/compiler 指令宿主绑定绕过 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-88059
暂无评论