CVE-2026-44437
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vulnerability in Angular SSR from 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 in X-Forwarded-Prefix header processing. The validation mechanism fails to account for URL-encoded characters, specifically dots (%2e%2e), allowing bypass of security filters via encoded path traversal sequences.
Risk Assessment
An attacker may bypass security filters and perform path traversal in an Angular SSR application deployed behind a trusted proxy.
Recommendation
Update Angular SSR to version 19.2.25, 20.3.25, 21.2.9, or 22.0.0-next.7 (or later).
Other vulnerabilities in Angular SSR
See all- CVE-2026-27739Critical
Angular SSR before versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 has a Server-Side Request Forgery (SSRF) vulnerability in request handling. The framework trusts user-controlled Host and X-Forwarded-* headers without validation, allowing attackers to direct requests to internal resources.
- CVE-2026-104871Medium
Angular SSR is a server-side rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. An unauthenticated requester can retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker.
- CVE-2025-62427High
Angular SSR (package @angular/ssr) before versions 19.2.18, 20.3.6, and 21.0.0-next.8 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL resolution mechanism. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\), the URL constructor treats it as a schema-relative URL, overriding the security-intended base URL (protocol, host, and port) and adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.
Original NVD description (English source)
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic. When an Angular SSR application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Prefix header without prior sanitization, an attacker can provide a payload such as /%2e%2e/evil. This vulnerability is fixed in19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS