Security Alert – CVE-2026-54266

[github-actions]

General Information

• Title: @angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning
• Category: vulnerabilities
• Severity: high
• Published date: 2026-06-22
• Short Description: @angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning

Affected Package

• Package name: @angular/common
• Fixed version: 22.0.1, 21.2.17, 20.3.25

Classification

• Rule: CVE-2026-54266
• Category: vulnerabilities
• Advisory URL: https://github.com/angular/angular

References

• https://github.com/angular/angular
• angular/angular@5f36274
• fix(common): use cryptographically secure SHA-256 for transfer cache key generation angular/angular#69153
• GHSA-39pv-4j6c-2g6v
• https://nvd.nist.gov/vuln/detail/CVE-2026-54266