# CVE-2026-111754: Angular platform-server open redirect via protocol-relative URLs in SSR

Source: https://junglewise.ai/threats/cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-111754 · Severity: medium · CVSS 4 · Published 2026-11-03

Angular's server-side rendering feature is vulnerable to open redirect attacks when processing certain malformed URLs. An attacker can craft URLs that bypass application-level protections and trick the server into redirecting users to arbitrary external websites. This affects only applications using server-side rendering; standard client-side Angular applications are unaffected.

Technologies: [Angular Platform-Server](https://junglewise.ai/threats/technologies/angular-platform-server-1), [@angular/platform-server (npm)](https://junglewise.ai/threats/technologies/angular-platform-server). Vendors: [Angular](https://junglewise.ai/threats/vendors/angular), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-111754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111754 being exploited in the wild.

**How severe is CVE-2026-111754?** Medium severity, with a CVSS score of 4, published 3 November 2026.

**Which products and versions are affected?** Angular Platform-Server before 22.2.1, 21.x before 21.2.25, 20.x before 20.3.33; Angular Ssr affected versions align with platform-server; @angular/platform-server (npm) >= 22.0.0, < 22.2.1, SEMVER:introduced=22.0.0,fixed=22.2.1.

**Is there a fix for CVE-2026-111754?** Yes. @angular/platform-server (npm): upgrade to 22.2.1 or later. Until then: Block requests containing `/.//`, `/..//`, or `/.;/` sequences at your reverse proxy or WAF (Nginx example provided). Alternatively, configure edge proxies to sanitize or disallow protocol-relative (`//`) Location response headers from the SSR upstream.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-20"
  },
  {
    "kind": "patched",
    "at": "2026-10-20",
    "note": "Versions 22.2.1, 21.2.25, 20.3.33 released"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111754 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111754?** Check whether you run Angular Platform-Server, Angular Ssr or @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/platform-server (npm): upgrade to 22.2.1 or later

  ```sh
  npm install @angular/platform-server@22.2.1
  ```


Block requests containing `/.//`, `/..//`, or `/.;/` sequences at your reverse proxy or WAF (Nginx example provided). Alternatively, configure edge proxies to sanitize or disallow protocol-relative (`//`) Location response headers from the SSR upstream.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-20"
  },
  {
    "kind": "patched",
    "at": "2026-10-20",
    "note": "Versions 22.2.1, 21.2.25, 20.3.33 released"
  }
]

## Technical details

The vulnerability exists in `ServerPlatformLocation.resolveUrl()` (or `parseUrl()` in v20), which performs a protocol-relative URL check before WHATWG URL normalization. Attackers bypass the initial `startsWith('//')` check by using dot-segments followed by slashes (e.g., `/.//evil.test`), which normalize to a pathname starting with `//` after WHATWG parsing. The SSR layer then emits the unnormalized pathname into the HTTP Location header, causing a protocol-relative redirect. Attack requires SSR enabled, parameter routes with child segments, and upstream reverse proxies that pass semicolons and dot-segments without normalization.

## Affected products

- Angular platform-server before 22.2.1, 21.x before 21.2.25, 20.x before 20.3.33
- Angular ssr affected versions align with platform-server

## Identifiers

- CVE-2026-111754
- GHSA-w739-gvwx-grc3

## Related threats

- [Angular platform-server denial of service via malformed DOCTYPE](https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed)
- [Angular platform-server SSR XSS via unescaped template in fallback elements](https://junglewise.ai/threats/cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in)
- [Angular platform-server XSS via ProcessingInstruction DOM serialization](https://junglewise.ai/threats/cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom)
- [Angular platform-server SSRF via URL resolution discrepancy](https://junglewise.ai/threats/cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy)
- [Angular SSR XSS in fallback raw-content elements](https://junglewise.ai/threats/cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements)