Is CVE-2026-33397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33397 being exploited in the wild.

How severe is CVE-2026-33397?

Low severity, with a CVSS score of 3.1, published 19 March 2026.

Which products and versions are affected?

@angular/ssr (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.2.

Is there a fix for CVE-2026-33397?

Yes. @angular/ssr (npm): upgrade to 22.0.0-next.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33397 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33397?

Check whether you run @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33397: Angular SSR protocol-relative URL injection via backslash bypass

CVE-2026-33397 · Severity: low · CVSS 3.1 · Published 2026-03-19

Angular SSR is a server-side rendering library for Angular web applications. An incomplete security fix allows attackers to inject malicious redirects by bypassing URL validation using a single backslash character. When deployed behind a proxy, this can cause users to be redirected to attacker-controlled domains for phishing, while also poisoning web caches to affect multiple users at scale and damage SEO rankings.

Technologies: @angular/ssr (npm). Vendors: npm.

Quick answers

Is CVE-2026-33397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33397 being exploited in the wild.
How severe is CVE-2026-33397?: Low severity, with a CVSS score of 3.1, published 19 March 2026.
Which products and versions are affected?: @angular/ssr (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.2.
Is there a fix for CVE-2026-33397?: Yes. @angular/ssr (npm): upgrade to 22.0.0-next.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33397 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33397?: Check whether you run @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/ssr (npm): upgrade to 22.0.0-next.2 or later
```
npm install @angular/ssr@22.0.0-next.2
```

Technical details

This is an open redirect vulnerability (CWE-601) in @angular/ssr stemming from an incomplete fix for CVE-2026-27738. The original patch blocked multiple leading slashes (///) but failed to account for a single backslash (\) bypass in URL validation. When an Angular SSR application processes the X-Forwarded-Prefix header from a proxy, an attacker can provide a value like \evil.com. The application prepends a forward slash, creating /\evil.com in the Location header. Modern browsers interpret /\ as //, treating it as a protocol-relative URL that redirects to the attacker's domain. Because the response lacks a Vary: X-Forwarded-Prefix header, the malicious redirect can be cached by intermediate proxies, poisoning the cache for all subsequent users. Network-reachable, requires no authentication or user privileges, but does require user interaction (following the redirect link). Patches are available in versions 20.3.21, 21.2.3, and 22.0.0-next.2.

Affected products

Angular @angular/ssr 20.0.0-next.0 through 20.3.20; 21.0.0-next.0 through 21.2.2; 22.0.0-next.0 through 22.0.0-next.1

Identifiers

CVE-2026-33397
GHSA-vfx2-hv2g-xj5f

Timeline

2026-03-19: disclosed
2026-03-19: patched: Patches released for versions 20.3.21, 21.2.3, and 22.0.0-next.2

References

https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.