Vulnerability	Vulnerable Version
H Exposure of Private Personal Information to an Unauthorized Actor @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the `newHeaders` function. An attacker can obtain sensitive credentials and session identifiers by triggering a cross-origin redirect to an attacker-controlled or untrusted domain. Note: This is only exploitable if the application uses the service worker to fetch assets with credentialed headers and those requests are redirected to a different origin. How to fix Exposure of Private Personal Information to an Unauthorized Actor? Upgrade `@angular/service-worker` to version 20.3.25, 21.2.17, 22.0.1 or higher.	<20.3.25>=21.0.0-next.0 <21.2.17>=22.0.0-next.0 <22.0.1

Exposure of Private Personal Information to an Unauthorized Actor

@angular/service-worker is an Angular - service worker tooling!

Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the newHeaders function. An attacker can obtain sensitive credentials and session identifiers by triggering a cross-origin redirect to an attacker-controlled or untrusted domain.

Note: This is only exploitable if the application uses the service worker to fetch assets with credentialed headers and those requests are redirected to a different origin.

How to fix Exposure of Private Personal Information to an Unauthorized Actor?

Upgrade @angular/service-worker to version 20.3.25, 21.2.17, 22.0.1 or higher.

<20.3.25>=21.0.0-next.0 <21.2.17>=22.0.0-next.0 <22.0.1

Go back to all versions of this package