{"action":"Upgrade @angular/common to 20.3.28 or later.","affected":[{"fixed":"22.1.1","introduced":"22.0.0"},{"fixed":"21.2.20","introduced":"21.0.0"},{"fixed":"20.3.28","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/common","cve_ids":["CVE-2026-88059"],"ecosystem":"npm","epss":0.00339,"exploited":false,"fixed_versions":["22.1.1","21.2.20","20.3.28"],"ghsa_id":"GHSA-p297-fm68-3q8c","id":"tcs_01M5KG266CQG1K4Y42S9N7KSVC","modified_at":"2026-09-10T20:30:04.431581512Z","published_at":"2026-09-10T20:19:19Z","references":["https://osv.dev/vulnerability/GHSA-p297-fm68-3q8c","https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c","https://github.com/angular/angular/issues/69777","https://github.com/angular/angular/pull/69778","https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af","https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d","https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56","https://github.com/angular/angular","https://github.com/angular/angular/releases/tag/v20.3.28","https://github.com/angular/angular/releases/tag/v21.2.20","https://github.com/angular/angular/releases/tag/v22.1.1"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-p297-fm68-3q8c","url":"https://osv.dev/vulnerability/GHSA-p297-fm68-3q8c"}],"summary":"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`"}