# CVE-2026-33397: Angular SSR protocol-relative URL injection via backslash bypass

Source: https://junglewise.ai/threats/cve-2026-33397-angular-ssr-protocol-relative-url-injection-via-backslash-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33397 · Severity: low · CVSS 3.1 · Published 2026-03-19

Angular SSR is a server-side rendering library for Angular web applications. An incomplete security fix allows attackers to inject malicious redirects by bypassing URL validation using a single backslash character. When deployed behind a proxy, this can cause users to be redirected to attacker-controlled domains for phishing, while also poisoning web caches to affect multiple users at scale and damage SEO rankings.

Technologies: [@angular/ssr (npm)](https://junglewise.ai/threats/technologies/angular-ssr). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33397 being exploited in the wild.

**How severe is CVE-2026-33397?** Low severity, with a CVSS score of 3.1, published 19 March 2026.

**Which products and versions are affected?** @angular/ssr (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.2.

**Is there a fix for CVE-2026-33397?** Yes. @angular/ssr (npm): upgrade to 22.0.0-next.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33397 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33397?** Check whether you run @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/ssr (npm): upgrade to 22.0.0-next.2 or later

  ```sh
  npm install @angular/ssr@22.0.0-next.2
  ```


## Technical details

This is an open redirect vulnerability (CWE-601) in @angular/ssr stemming from an incomplete fix for CVE-2026-27738. The original patch blocked multiple leading slashes (///) but failed to account for a single backslash (\) bypass in URL validation. When an Angular SSR application processes the X-Forwarded-Prefix header from a proxy, an attacker can provide a value like \evil.com. The application prepends a forward slash, creating /\evil.com in the Location header. Modern browsers interpret /\ as //, treating it as a protocol-relative URL that redirects to the attacker's domain. Because the response lacks a Vary: X-Forwarded-Prefix header, the malicious redirect can be cached by intermediate proxies, poisoning the cache for all subsequent users. Network-reachable, requires no authentication or user privileges, but does require user interaction (following the redirect link). Patches are available in versions 20.3.21, 21.2.3, and 22.0.0-next.2.

## Affected products

- Angular @angular/ssr 20.0.0-next.0 through 20.3.20; 21.0.0-next.0 through 21.2.2; 22.0.0-next.0 through 22.0.0-next.1

## Identifiers

- CVE-2026-33397
- GHSA-vfx2-hv2g-xj5f

## Timeline

- 2026-03-19: disclosed
- 2026-03-19: patched: Patches released for versions 20.3.21, 21.2.3, and 22.0.0-next.2

## References

- [https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5f](https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5f)

## Related threats

- [Angular SSR path traversal via backslash on Windows](https://junglewise.ai/threats/cve-2026-104871-the-angular-ssr-is-a-server-rise-rendering-tool-for-angular)
- [Angular SSR path traversal in X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-44437-angular-ssr-path-traversal-in-x-forwarded-prefix-header)
- [Angular SSR SSRF and header injection in request handling](https://junglewise.ai/threats/cve-2026-27739-angular-ssr-ssrf-and-header-injection-in-request-handling)
- [Angular SSR open redirect via X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-27738-angular-ssr-open-redirect-via-x-forwarded-prefix-header)
- [Angular SSR server-side request forgery in URL resolution](https://junglewise.ai/threats/cve-2025-62427-angular-ssr-server-side-request-forgery-in-url-resolution)