fix(deps): update dependency @angular/service-worker to v20.3.25 [security] by renovate[bot] · Pull Request #69 · damoeb/feedless

renovate · 2026-08-29T08:01:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/service-worker (source)	`20.3.3` → `20.3.25`

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

CVE-2026-50169 / GHSA-gv2q-mqqv-365m

More information

Details

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function.

During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the browser's default 'follow' strategy.

If the target web application makes client-side requests with a strict policy (e.g., expecting a network error instead of automatically following redirects), the service worker will bypass this instruction and automatically follow HTTP 3xx redirects to other destinations. This acts as an unintended proxy/intermediary ("Confused Deputy") and can result in cookie/credential exposure or same-origin session-restricted data leakage if public dynamic routes redirect to sensitive routes.

Impact

Web applications registering the @angular/service-worker package are vulnerable to this redirect-policy bypass if they make safe client-side fetch calls (such as { redirect: 'error' }) to paths matched by a service worker asset group (such as lazy-loaded JavaScript bundles or dynamic public assets) that can return HTTP redirects to authenticated same-origin secure endpoints.

By stripping developer-defined safety boundaries, the service worker allows the browser to transparently query and return data from credentials-guarded resources that should have been blocked at the network barrier.

Attack Preconditions

To successfully exploit this vulnerability, all of the following application states and parameters must concurrently exist:

Active Angular Service Worker: The target application uses @angular/service-worker and has an active registration of ngsw-worker.js inside the client's browser context.
Asset Group Matching: An assetGroups pattern in ngsw-config.json encompasses the target dynamic routing endpoint.
Same-Origin Dynamic Redirection: The server routes a public matched asset route to a service that returns an HTTP 3xx redirect pointing to a sensitive, session-restricted same-origin private route (e.g., /private/account-summary.json).
Established User Session: The victim user currently has an active authentication state, such as valid same-origin session cookies or auth headers stored by the browser.
Client-Side Safe Fetch Call: The application initiates an explicit fetch request to the route with safety parameters: { redirect: 'error' }.

Mitigations & Workarounds

If upgrading the @angular/service-worker package is not immediately feasible, developers should implement the following defensive measures:

Avoid Public-to-Private Dynamic Redirection: Refactor the server architecture so that public paths matched by service worker asset groups never issue HTTP 3xx redirects to authenticated same-origin secure endpoints.
Strict Cookie Configuration: Apply strict flags to session cookies (SameSite=Strict; Secure; HttpOnly) and consider explicit route isolations (such as subdomains) for credential-guarded private resources.
Exclude Secure Endpoints from SW Config: Verify your ngsw-config.json settings and ensure that patterns targeting dynamic, secure endpoints are explicitly excluded from automatic asset groups or caching scopes.

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

CVSS Score: 5.7 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@angular/service-worker: Request Credential & Cache Policy Stripping

CVE-2026-50184 / GHSA-95qp-cmmw-mgqv

More information

Details

An issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function.

During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties).

This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout.

Impact

Web applications registering the @angular/service-worker package are vulnerable to credential exposure or post-logout cache persistence if client-side code relies on fetch calls with explicit safety attributes (such as { credentials: 'omit' } or { cache: 'no-store' }) targeting paths matched by service worker asset groups.

By stripping these safety boundaries, the service worker exposes same-origin cookies and dynamic sensitive data to endpoints that should not receive them, or retains dynamic user sessions in cache storage where logout operations fail to fully evict user records.

Attack Preconditions

To successfully exploit this vulnerability, all of the following application states and parameters must concurrently exist:

Active Angular Service Worker: The target application uses @angular/service-worker and has an active registration of ngsw-worker.js inside the client's browser context.
Asset Group Matching: An assetGroups pattern in ngsw-config.json encompasses the target dynamic routing endpoint.
Established User Session: The victim user currently has an active authentication state, such as valid same-origin session cookies or auth headers stored by the browser.
Client-Side Safe Fetch Call: The application initiates an explicit fetch request to the route with safety parameters: { credentials: 'omit' } or specific cache control parameters (e.g. { cache: 'no-store' }).

Mitigations & Workarounds

If upgrading the @angular/service-worker package is not immediately feasible, developers should implement the following defensive measures:

Strict Cookie Configuration: Apply strict flags to session cookies (SameSite=Strict; Secure; HttpOnly) and ensure complete route isolation for credential-guarded secure resources.
Exclude Secure Endpoints from SW Config: Ensure that patterns targeting dynamic, secure endpoints are explicitly excluded from automatic asset groups or caching scopes in your ngsw-config.json.

Post-Logout Cache Invalidation: Programmatically purge the browser's Cache Storage API entries registered by the Angular Service Worker upon user logout:

if ('caches' in window) {
  caches.keys().then(names => {
    for (let name of names) {
      if (name.startsWith('ngsw:')) {
        caches.delete(name);
      }
    }
  });
}

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

CVSS Score: 5.7 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

CVE-2026-54264 / GHSA-qxh6-94w6-9r5p

More information

Details

An information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm.

This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin.

Impact

If an application configured with the Angular Service Worker fetches assets with credential headers (such as Authorization header), and one of those requests is redirected to a different origin, the Service Worker will forward those headers to the new origin. This exposes critical credentials and session identifiers to unauthorized third-party servers.

Attack Preconditions

For this vulnerability to be exploitable:

Vulnerable Configuration: The application must utilize the @angular/service-worker package to fetch assets.
Credentialed Requests: The application must attach sensitive request headers (like Authorization, Proxy-Authorization, or rely on cookies) to asset-group requests.
Redirect Flow: These requests must encounter a cross-origin redirect to an attacker-controlled or untrusted domain.

Patched Versions

22.0.1
21.2.17
20.3.25

Credits

This vulnerability was discovered and reported by CodeMender from Google DeepMind.

Severity

CVSS Score: 8.3 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/service-worker)

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

Commit	Type	Description
3d135ce59b	fix	add upper bounds for digitsInfo
39a4b4cc8e	fix	sanitize placeholder

Commit	Type	Description
8f35b182b1	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68926)
64a89e917a	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68926)
6404edfe0a	fix	strip namespaced SVG script elements during template compilation (#68926)

Commit	Type	Description
e345a58069	fix	normalize tag names in runtime i18n attribute security context lookup (#68926)
d86e4e7b2a	fix	reject script element as a dynamic component host (#68926)
af04936045	fix	sanitize meta selectors
dc631efa96	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68926)
909ef047b3	fix	synchronize core sanitization schema with compiler (#68926)

Commit	Type	Description
de7b2a62e7	fix	exclude withCredentials requests from transfer cache
4233188d8e	fix	skip TransferCache for cookie-bearing requests by default

Commit	Type	Description
5fdfd8a998	fix	preserve redirect policy on reconstructed asset requests
83b022f2d0	fix	Preserves explicit 'credentials: omit' in asset requests
e617fa06eb	fix	Preserves HTTP cache mode in asset group requests

Commit	Type	Description
f9d0818087	fix	support arbitrary nesting in :host-context()
106b9040df	fix	support commas in :host() argument
9419ea348a	fix	support complex selectors in :nth-child()
036c5d2a07	fix	support one additional level of nesting in :host()

Commit	Type	Description
4c89a267c3	fix	pass element removal property through in all locations (#64565)
2fad4d4ab6	fix	prevent duplicate nodes from being retained with fast `animate.leave`` calls (#64592)

Commit	Type	Description
cfd8ed3fff	fix	Fix outlet serialization and parsing with no primary children (#64505)
182fe78f91	fix	Surface parse errors in Router.parseUrl (#64503)

Commit	Type	Description
8dec92ff9f	fix	capture metadata for undecorated fields (#63957) (#64317)
c2e817b0ef	perf	fix performance of "interpolated signal not invoked" check (#64410)

Commit	Type	Description
a9bcffdbc7	fix	disallow event attribute bindings in host bindings unconditionally (#68468)
97eeb45cfa	fix	validate security-sensitive attributes in i18n bindings (#68468)

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

Commit	Type	Description
f15cfa4cc4	fix	fixes regression in `animate.leave` function bindings (#64413)
d54dd674ca	fix	Prevents early style pruning with leave animations (#64335)

Commit	Type	Description
554573e524	fix	migrating input with more than 1 usage in a method (#64367)
2c79ca0b57	fix	remove error for no matching files in control flow migration (#64253) (#64314)

Commit	Type	Description
853ed169a8	fix	ensure missing leave animations don't queue leave animations (#64226)
6fed986b7a	fix	Fixes animations in conjunction with content projection (#63776)
76fe5599fe	fix	handle undefined CSS time values in parseCssTimeUnitsToMs function (#64181)
3b959105be	fix	prevent early exit from leave animations when multiple transitions are present (#64225)

Conversation

renovate Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

Details

Impact

Attack Preconditions

Mitigations & Workarounds

Patches

Severity

References

@​angular/service-worker: Request Credential & Cache Policy Stripping

Details

Impact

Attack Preconditions

Mitigations & Workarounds

Patches

Severity

References

@​angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

Details

Impact

Attack Preconditions

Patched Versions

Credits

Severity

References

Release Notes

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

platform-server

compiler

common

compiler

core

http

platform-server

service-worker

platform-server

core

platform-server

platform-server

compiler

core

Breaking Changes

core

core

core

compiler

http

common

compiler

core

compiler-cli

migrations

animations

compiler

compiler-cli

core

router

core

platform-browser

compiler-cli

core

migrations

router

core

migrations

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

renovate Bot commented Aug 29, 2026 •

edited

Loading

@angular/service-worker: Request Credential & Cache Policy Stripping

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker