CVE-2026-68945 is a cache poisoning vulnerability in Angular's HttpTransferCache that affects server-side rendering pipelines. When building cache keys for HTTP responses, Angular joins multi-valued query parameters with commas—semantically collapsing an ordered tuple into an unordered set. This means /api?userId=1&sessionToken=abc and /api?sessionToken=abc&userId=1 resolve to identical cache entries despite representing different server-side execution contexts.
In SSR, these cached responses serialize directly into the HTML shell delivered to clients. A response intended for User A's authorization state can hydrate User B's page if their parameter ordering happens to collide, creating cross-user data leakage that manifests as intermittent, order-dependent bugs—hard to detect because it looks like application logic errors rather than exploitation.
The CVSS 8.8 reflects the authorization boundary violation. The EPSS of 0.00193 likely reflects detection difficulty: the vulnerability produces non-deterministic leakage that blends into normal application behavior rather than triggering obvious exploit signatures.
Your remediation depends on whether your downstream stack treats parameter order as semantically significant. PHP, Node.js, and Ruby treat query parameters as order-insensitive by default—in those stacks, this maps to full cache poisoning. Go and Java applications may have partial inherent protection through consistent parameter ordering, but be cautious: reverse proxies and load balancers frequently reorder parameters before reaching your application, potentially negating incidental protection.
The fix is parameter-key sorting or array-consistent serialization in cache key construction. However, this is the third Angular SSR cache flaw in two years—suggesting the HttpTransferCache abstraction systematically under-specifies equivalence semantics across parameter ordering, encoding variants, and fragment identifiers. Verify your Angular version against 20.3.x, 21.2.x, and 22.0.x patches, and audit whether your SSR pipeline has custom cache layers that may carry similar semantic assumptions.