{"action":"Upgrade @angular/common to 20.3.25 or later.","affected":[{"fixed":"22.0.1","introduced":"22.0.0-next.0"},{"fixed":"21.2.17","introduced":"21.0.0-next.0"},{"fixed":"20.3.25","introduced":"20.0.0-next.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/common","cve_ids":["CVE-2026-54266"],"ecosystem":"npm","epss":0.00127,"exploited":false,"fixed_versions":["22.0.1","21.2.17","20.3.25"],"ghsa_id":"GHSA-39pv-4j6c-2g6v","id":"tcs_01M5KEWW54F5FQ62THDPCYWK8X","modified_at":"2026-09-10T03:50:55.363581233Z","published_at":"2026-06-15T17:24:02Z","references":["https://osv.dev/vulnerability/GHSA-39pv-4j6c-2g6v","https://github.com/angular/angular/security/advisories/GHSA-39pv-4j6c-2g6v","https://nvd.nist.gov/vuln/detail/CVE-2026-54266","https://github.com/angular/angular/pull/69153","https://github.com/angular/angular/commit/5f36274da3f961430ae72865159afa02a1dd9133","https://github.com/angular/angular"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-39pv-4j6c-2g6v","url":"https://osv.dev/vulnerability/GHSA-39pv-4j6c-2g6v"}],"summary":"@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning"}