CVE-2026-88059

Executive Summary

CVE-2026-88059 is an information-disclosure vulnerability in Angular's @angular/common HttpTransferCache, where an authenticated HTTP response can be serialized into server-side rendered (SSR) HTML and subsequently served to an unauthenticated or unauthorized visitor. The flaw is exploitable only in applications that combine SSR with client hydration (provideClientHydration), a hierarchical HttpClient that delegates requests via withRequestsMadeViaParent, and parent-level credential injection, while sharing rendered HTML through a CDN, reverse proxy, or application cache. Impact is limited to confidentiality (CVSS base 4.0), but the leak can expose one user's private response data — including tokens or personal data returned by APIs — to another user.

Technical Analysis

Angular's SSR pipeline can transfer HTTP responses fetched on the server into the client through a mechanism called TransferState, embedded in the served HTML inside a <script id="ng-state" type="application/json"> element. The HttpTransferCache is the component responsible for deciding which server-side HTTP responses are safe to serialize into that state object. CVE-2026-88059 describes a logic flaw in that decision process when HttpClient is configured hierarchically.

The vulnerability arises from the ordering and scope of cache evaluation across the HttpInterceptor chain:

1. A child HttpClient instance is configured with withRequestsMadeViaParent, which defers interceptor execution to a parent injector's HttpClient.
2. When an SSR request arrives, the child TransferCache evaluates the outgoing request before delegation occurs. At that point, no credential has yet been attached — the request appears anonymous.
3. The request is then delegated to the parent, whose withInterceptors chain adds an Authorization header, a cookie, or an API token.
4. Because credentials were injected after the child's evaluation, the parent's own TransferCache correctly recognizes the request as authenticated and skips caching it.
5. The child, however, has already committed the request to its cache allow-list and stores the corresponding response — which is now an authenticated, user-specific payload — in TransferState.
6. That response is serialized as JSON into ng-state within the SSR HTML output.

Once the personalized HTML leaves the origin server, any shared cache layer (CDN, reverse proxy, or application-level cache) can serve it to a different user. A later unauthenticated or unauthorized visitor receives the cached HTML containing the prior authenticated user's sensitive response data.

The core weakness class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a credential-context mismatch between two caching layers that both inspect the same request at different points in the interceptor chain. The NVD description does not name specific interceptor functions beyond withRequestsMadeViaParent, provideClientHydration, and withHttpTransferCacheOptions; no further internal method names are asserted here.

The condition set required for exploitation is narrow, which is consistent with the CVSS temporal/environmental modifiers — the base vector itself is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N, indicating high attack complexity, no privileges required, no user interaction, a scope change, and limited confidentiality impact only.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-88059 (POC_STATUS: None; Nuclei template: NO; exploit code: NO). The attack chain below is inferred strictly from the NVD description and the vulnerability class.

Step 1 — Reconnaissance / target identification. Identify an Angular SSR application that returns hydrated HTML containing an ng-state JSON script element. Indicators include ng-server-context, ng-state, or Angular hydration attributes in responses. The operator must confirm the server-side rendering path is reachable by unauthenticated clients and that responses are fronted by a CDN, reverse proxy, or application cache that shares rendered HTML across users.

Step 2 — Precondition confirmation. The attacker does not control the vulnerable configuration; it must already be deployed. Exploitation requires the target application to simultaneously satisfy: SSR + hydration enabled via provideClientHydration; a child HttpClient delegating with withRequestsMadeViaParent; credentials injected at a parent interceptor level; and shared caching of HTML across users. An external attacker can only observe the effect (receiving another user's data), not configure these conditions.

Step 3 — Triggering the flaw. An authenticated user browses a page whose data is fetched by the mis-cached endpoint. The server's child TransferCache evaluates the request pre-delegation, judges it anonymous, and stores the authenticated response in ng-state. The rendered HTML is placed in the shared cache keyed by URL (not by user identity).

Step 4 — Data retrieval. A subsequent unauthenticated or lower-privileged visitor requests the same URL. The shared cache returns the earlier user's HTML, and the embedded ng-state JSON now contains the prior user's private response data — potentially API tokens, personally identifiable information, or account-scoped records. Extraction requires only reading the delivered HTML; no tooling beyond an HTTP client is needed.

Step 5 — Post-exploitation impact. The disclosed data depends entirely on what the cached endpoint returned. Per the description, this can include responses carrying an Authorization header value, cookies, or API tokens — enabling horizontal privilege escalation, session hijacking, or further enumeration. Because exploitation is passive from the attacker's perspective, it can occur at scale against any URL that lands in the shared cache while an authenticated user is active.

Impact Assessment

The CVSS 3.1 base vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N, yielding a base score of 4.0 (Medium). Interpretation by subscore:

• AV:N (Network) — exploitable remotely over standard HTTP(S); no local access needed.
• AC:H (High) — success depends on a precise configuration combination (SSR + hydration, withRequestsMadeViaParent, parent-level credential injection, and cross-user HTML caching). Not every Angular SSR deployment is affected.
• PR:N / UI:N — the attacker needs no prior account and no victim interaction; the authenticated user's normal browsing is sufficient to seed the cache.
• S:C (Scope Changed) — impact crosses a security boundary: the data originates from one security authority (the authenticated user's context) and is delivered to another (unauthenticated visitor).
• C:L (Low) — limited confidentiality impact; only data present in the cached response is exposed, and it is a snapshot rather than a full compromise.
• I:N / A:N — no integrity or availability impact.

Business impact. This is a cross-user data leakage issue. In a shared-cache deployment, the blast radius equals every endpoint that satisfies the vulnerable pattern and lands in the cache. Sensitive payloads may include tokens or credentials (explicitly named in the description), which raises the risk of account takeover — a consequence disproportionate to the 4.0 base score. Regulatory exposure (GDPR/CCPA) applies if personal data is disclosed. Enterprise SOC teams should treat any confirmed instance as a potential incident, not merely a configuration bug.

Detection Guidance

Detection focuses on two surfaces: (a) HTTP responses containing an ng-state payload while an authenticated set of credentials was involved, and (b) cache-serving behavior where personalized HTML crosses identity boundaries. Because CVSS rates this Medium and the exploit is passive, detection rules emphasize observability of SSR/cache anomalies rather than exploit signatures.

Sigma Rule

title: Angular SSR TransferState Exposure (CVE-2026-88059)
id: 8f4c1a92-3b7e-4e21-9a55-angular88059
status: experimental
description: Detects SSR responses carrying Angular ng-state transfer cache data that may leak authenticated response bodies to unauthenticated users (CVE-2026-88059).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88059
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_state:
    response_body|contains: 'id="ng-state"'
  selection_serialized:
    response_body|contains:
      - 'Authorization'
      - 'Bearer '
      - 'Set-Cookie'
  selection_ssr:
    response_body|contains: 'ng-server-context'
  condition: selection_state and (selection_serialized or selection_ssr)
falsepositives:
  - Legitimate SSR responses with non-sensitive ng-state content
  - Applications intentionally embedding public API tokens
level: medium
tags:
  - attack.t1213
  - cve.2026.88059

YARA Rule

rule CVE_2026_88059_Angular_TransferState_Leak
{
    meta:
        author      = "valtersit.com"
        description = "Detects Angular SSR HTML embedding ng-state JSON that may contain authenticated response data (CVE-2026-88059)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-88059"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $ng_state   = "id=\"ng-state\""
        $ng_state2  = "'ng-state'"
        $ng_state3  = "<script id=\"ng-state\" type=\"application/json\">"
        $ssr_ctx    = "ng-server-context"
        $auth1      = "Authorization"
        $auth2      = "Bearer "
        $token      = "apiToken"
        $cookie     = "Set-Cookie"

    condition:
        (any of ($ng_state*) or $ssr_ctx) and
        (any of ($auth*) or $token or $cookie) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88059 Angular SSR ng-state transfer cache exposure"; flow:to_client,established; http.header_names; content:"Content-Type"; nocase; http.response_body; content:"ng-state"; nocase; content:"Authorization"; nocase; distance:0; within:4096; reference:cve,2026-88059; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88059; classtype:attempted-recon; sid:8805926; rev:1;)

Note: Suricata's inspection of response bodies for JSON-serialized tokens is best-effort; tune within and clustering offsets to reduce false positives on legitimate SSR pages.

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where http.response.status_code == 200 and
      http.response.body : "ng-state" and
      http.response.body : ("Authorization" or "Bearer " or "Set-Cookie") ]
  [ network where http.response.status_code == 200 and
      http.response.body : "ng-state" and
      not user.name : "*" ]

This EQL sequence correlates the response that seeded the cache with a later unauthenticated retrieval of the same Angular SSR payload, surfacing the cross-user disclosure pattern.

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx
| eval personalized=if(match(_raw, "(?i)ng-state") AND match(_raw, "(?i)(authorization|bearer|set-cookie|apitoken)"), 1, 0)
| where personalized=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as paths, dc(clientip) as distinct_clients
        by host, uri
| where distinct_clients > 1
| convert ctime(first_seen) ctime(last_seen)
| sort - distinct_clients

The query flags Angular SSR URLs serving credential-bearing ng-state payloads to more than one distinct client — a strong signal of shared-cache leakage.

Wazuh OSSEC Rule

<group name="web,angular,cve-2026-88059,">
  <rule id="880590" level="8">
    <decoded_as>json</decoded_as>
    <field name="response_body">ng-state</field>
    <field name="response_body">Authorization</field>
    <description>CVE-2026-88059: Angular SSR response contains ng-state with credential-bearing data (possible cross-user leak)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="880591" level="6">
    <decoded_as>json</decoded_as>
    <field name="response_body">ng-state</field>
    <field name="response_body">Set-Cookie</field>
    <description>CVE-2026-88059: Angular SSR ng-state payload includes cookie material</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Angular 20.3.28, 21.2.20, and 22.1.1, but no vendor advisory or commit reference was supplied to this report, and no patch source was independently tracked. Treat these versions as the stated remediation targets and verify against the official Angular changelog before relying on them.

1) Immediate mitigations (apply before upgrade if deployment is exposed):

• Attach credentials at the child HttpClient level rather than relying on parent-level injection, so the child TransferCache evaluates the request with credential context present.
• Filter sensitive endpoints out of the transfer cache using withHttpTransferCacheOptions.
• Disable transfer caching entirely for sensitive or personalized routes.
• Mark personalized SSR HTML responses Cache-Control: private or no-store and ensure the CDN/reverse proxy honors those directives, preventing cross-user HTML reuse.
• Audit shared caches (CDN, reverse proxy, application cache) for any HTML keyed purely by URL that could contain ng-state payloads.

2) Patch / upgrade steps:

• Upgrade @angular/common to 20.3.28, 21.2.20, or 22.1.1 (or later) as stated in the NVD description.
• Rebuild and redeploy the SSR application; purge all previously cached personalized HTML from CDN and proxy layers.
• Rotate any credentials (tokens, cookies) that may have been exposed in cached ng-state payloads.

3) Long-term hardening:

• Adopt a policy that any authenticated response is excluded from SSR TransferState by default, with explicit opt-in only for non-sensitive, non-personalized data.
• Enforce Cache-Control and Vary headers at the edge for all SSR routes; use Vary: Cookie, Authorization where applicable.
• Add CI/CD checks that flag withRequestsMadeViaParent combined with parent-level credential injection and active HttpTransferCache.
• Monitor ng-state responses in runtime logging for credential-like content (see Detection Guidance) and alert on cross-client delivery.

References

1. NVD — CVE-2026-88059: https://nvd.nist.gov/vuln/detail/CVE-2026-88059
2. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
3. Angular official documentation on SSR hydration and HttpClient: https://angular.dev (verify current guidance on provideClientHydration, HttpTransferCache, and withRequestsMadeViaParent).
4. Angular changelog / release notes for versions 20.3.28, 21.2.20, 22.1.1 (primary source for fix confirmation).
5. CISA KEV Catalog: not applicable — CVE-2026-88059 is NOT listed in CISA KEV. No public proof-of-concept, exploit code, or Nuclei template was identified at time of writing; EPSS has not yet been scored by FIRST.org.