Vulnerability	Vulnerable Version
H Insufficient Verification of Data Authenticity Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the `HttpTransferCache` used for server-side rendering, which builds the transfer-cache key by joining repeated `HttpParams` values with commas so that distinct parameter shapes produce the same key. An attacker can poison the SSR transfer cache and cause one request's response to be served for another by sending a request whose comma-separated scalar value, such as `role=user,admin`, serializes identically to a legitimate request built with repeated parameters, such as `append('role', 'user').append('role', 'admin')`. This affects SSR applications using `HttpClient` where the same URL is requested with repeated query parameters. How to fix Insufficient Verification of Data Authenticity? Upgrade `@angular/common` to version 20.3.27, 21.2.19, 22.0.2 or higher.	<20.3.27>=21.0.0-next.0 <21.2.19>=22.0.0-next.0 <22.0.2

Insufficient Verification of Data Authenticity

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the HttpTransferCache used for server-side rendering, which builds the transfer-cache key by joining repeated HttpParams values with commas so that distinct parameter shapes produce the same key. An attacker can poison the SSR transfer cache and cause one request's response to be served for another by sending a request whose comma-separated scalar value, such as role=user,admin, serializes identically to a legitimate request built with repeated parameters, such as append('role', 'user').append('role', 'admin'). This affects SSR applications using HttpClient where the same URL is requested with repeated query parameters.

How to fix Insufficient Verification of Data Authenticity?

Upgrade @angular/common to version 20.3.27, 21.2.19, 22.0.2 or higher.

<20.3.27>=21.0.0-next.0 <21.2.19>=22.0.0-next.0 <22.0.2

Go back to all versions of this package