Executive brief
Angular SSR is a server-side rendering library for Angular web applications. An incomplete security fix allows attackers to inject malicious redirects by bypassing URL validation using a single backslash character. When deployed behind a proxy, this can cause users to be redirected to attacker-controlled domains for phishing, while also poisoning web caches to affect multiple users at scale and damage SEO rankings.
Technical details
This is an open redirect vulnerability (CWE-601) in @angular/ssr stemming from an incomplete fix for CVE-2026-27738. The original patch blocked multiple leading slashes (///) but failed to account for a single backslash (\) bypass in URL validation. When an Angular SSR application processes the X-Forwarded-Prefix header from a proxy, an attacker can provide a value like \evil.com. The application prepends a forward slash, creating /\evil.com in the Location header. Modern browsers interpret /\ as //, treating it as a protocol-relative URL that redirects to the attacker's domain. Because the response lacks a Vary: X-Forwarded-Prefix header, the malicious redirect can be cached by intermediate proxies, poisoning the cache for all subsequent users. Network-reachable, requires no authentication or user privileges, but does require user interaction (following the redirect link). Patches are available in versions 20.3.21, 21.2.3, and 22.0.0-next.2.
Affected products
- Angular @angular/ssr 20.0.0-next.0 through 20.3.20; 21.0.0-next.0 through 21.2.2; 22.0.0-next.0 through 22.0.0-next.1
Timeline
- 2026-03-19: disclosed
- 2026-03-19: patched: Patches released for versions 20.3.21, 21.2.3, and 22.0.0-next.2