Is CVE-2026-104871 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104871 being exploited in the wild.

How severe is CVE-2026-104871?

Medium severity, with a CVSS score of 4, published 2 October 2026.

Which products and versions are affected?

Google @Angular/Ssr prior to 22.1.7; @angular/ssr (npm) SEMVER:introduced=22.0.0,fixed=22.1.7.

Is there a fix for CVE-2026-104871?

Yes. @angular/ssr (npm): upgrade to 22.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104871 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104871?

Check whether you run Google @Angular/Ssr or @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104871: Angular SSR path traversal via backslash on Windows

CVE-2026-104871 · Severity: medium · CVSS 4 · Published 2026-10-02

Angular's server-side rendering engine for web applications contains a path-traversal vulnerability on Windows that allows unauthenticated attackers to retrieve prerendered HTML pages from sibling directories. An attacker can exploit this by crafting URLs with backslash separators to bypass directory containment checks and access pages outside the intended public directory.

Technologies: Google @Angular/Ssr, @angular/ssr (npm). Vendors: Google, npm.

Quick answers

Is CVE-2026-104871 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104871 being exploited in the wild.
How severe is CVE-2026-104871?: Medium severity, with a CVSS score of 4, published 2 October 2026.
Which products and versions are affected?: Google @Angular/Ssr prior to 22.1.7; @angular/ssr (npm) SEMVER:introduced=22.0.0,fixed=22.1.7.
Is there a fix for CVE-2026-104871?: Yes. @angular/ssr (npm): upgrade to 22.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104871 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104871?: Check whether you run Google @Angular/Ssr or @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/ssr (npm): upgrade to 22.1.7 or later
```
npm install @angular/ssr@22.1.7
```

Technical details

The CommonEngine.retrieveSSGPage function uses a simple string startsWith() check to validate that resolved file paths remain within the configured publicPath, but this check fails to account for Windows backslash path separators and sibling directories with matching name prefixes. An unauthenticated attacker can supply relative URLs containing backslash parent-traversal segments; the resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the containment check incorrectly accepts a sibling directory whose name shares the publicPath prefix. The vulnerability only affects Windows deployments that pass relative request URLs to CommonEngine.render and have prefix-sharing sibling output directories containing prerendered Angular HTML.

Affected products

Google @angular/ssr 17 through 18
Google @angular/ssr prior to 20.3.36
Google @angular/ssr prior to 21.2.23
Google @angular/ssr prior to 22.1.7

Identifiers

CVE-2026-104871
GHSA-7g7c-h8rr-7p6q

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.