@angular/service-worker 21.2.14

Direct Vulnerabilities

Known vulnerabilities in the @angular/service-worker package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Use of Cache Containing Sensitive Information @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session data or cached private resources by exploiting the stripping of explicit client-defined safety parameters, causing credentials to be sent when they should be omitted or private data to persist in cache. Note: This is only exploitable if the application uses an active Angular Service Worker, the asset group pattern matches the targeted endpoint, the user has an active authenticated session, and the client initiates a fetch request with explicit safety parameters. How to fix Use of Cache Containing Sensitive Information? Upgrade `@angular/service-worker` to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.	<19.2.23>=20.0.0-next.0 <20.3.22>=21.0.0-next.0 <21.2.15>=22.0.0-next.0 <22.0.0-rc.2
H Exposure of Private Personal Information to an Unauthorized Actor @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the `newHeaders` function. An attacker can obtain sensitive credentials and session identifiers by triggering a cross-origin redirect to an attacker-controlled or untrusted domain. Note: This is only exploitable if the application uses the service worker to fetch assets with credentialed headers and those requests are redirected to a different origin. How to fix Exposure of Private Personal Information to an Unauthorized Actor? Upgrade `@angular/service-worker` to version 20.3.25, 21.2.17, 22.0.1 or higher.	<20.3.25>=21.0.0-next.0 <21.2.17>=22.0.0-next.0 <22.0.1
M Use of Cache Containing Sensitive Information @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session-restricted data or expose credentials by exploiting automatic redirect handling when a service worker intercepts requests and strips strict redirect policies. Note: This is only exploitable if the application uses an active Angular Service Worker, has asset group patterns matching dynamic endpoints, the server issues HTTP 3xx redirects from public to private routes, the user has an active authenticated session, and the client initiates fetch requests with strict redirect parameters. How to fix Use of Cache Containing Sensitive Information? Upgrade `@angular/service-worker` to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-next.4 or higher.	<19.2.23>=20.0.0-next.0 <20.3.22>=21.0.0-next.0 <21.2.15>=22.0.0-next.0 <22.0.0-next.4

Vulnerability

Vulnerable Version

Use of Cache Containing Sensitive Information

@angular/service-worker is an Angular - service worker tooling!

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session data or cached private resources by exploiting the stripping of explicit client-defined safety parameters, causing credentials to be sent when they should be omitted or private data to persist in cache.

Note: This is only exploitable if the application uses an active Angular Service Worker, the asset group pattern matches the targeted endpoint, the user has an active authenticated session, and the client initiates a fetch request with explicit safety parameters.

How to fix Use of Cache Containing Sensitive Information?

Upgrade @angular/service-worker to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

<19.2.23>=20.0.0-next.0 <20.3.22>=21.0.0-next.0 <21.2.15>=22.0.0-next.0 <22.0.0-rc.2

Exposure of Private Personal Information to an Unauthorized Actor

@angular/service-worker is an Angular - service worker tooling!

Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the newHeaders function. An attacker can obtain sensitive credentials and session identifiers by triggering a cross-origin redirect to an attacker-controlled or untrusted domain.

Note: This is only exploitable if the application uses the service worker to fetch assets with credentialed headers and those requests are redirected to a different origin.

How to fix Exposure of Private Personal Information to an Unauthorized Actor?

Upgrade @angular/service-worker to version 20.3.25, 21.2.17, 22.0.1 or higher.

<20.3.25>=21.0.0-next.0 <21.2.17>=22.0.0-next.0 <22.0.1

Use of Cache Containing Sensitive Information

@angular/service-worker is an Angular - service worker tooling!

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session-restricted data or expose credentials by exploiting automatic redirect handling when a service worker intercepts requests and strips strict redirect policies.

Note: This is only exploitable if the application uses an active Angular Service Worker, has asset group patterns matching dynamic endpoints, the server issues HTTP 3xx redirects from public to private routes, the user has an active authenticated session, and the client initiates fetch requests with strict redirect parameters.

How to fix Use of Cache Containing Sensitive Information?

Upgrade @angular/service-worker to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-next.4 or higher.

<19.2.23>=20.0.0-next.0 <20.3.22>=21.0.0-next.0 <21.2.15>=22.0.0-next.0 <22.0.0-next.4

@angular/service-worker@21.2.14

Angular - service worker tooling!

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically