CVE-2026-44437: Angular SSR path traversal in X-Forwarded-Prefix header

CVE-2026-44437 · Severity: medium · CVSS 6.1 · Published 2026-05-13

Angular SSR, a tool used to speed up web applications by rendering pages on the server, contains a vulnerability in how it handles specific web traffic headers. An attacker can use specially crafted web requests to trick the server into redirecting users to malicious websites or making unauthorized internal network requests. This could lead to users being phished or the exposure of internal services not intended for public access.

Technologies: Google SSR, @angular/ssr (npm). Vendors: Google, npm.

Quick answers

Is CVE-2026-44437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44437 being exploited in the wild.
How severe is CVE-2026-44437?
Medium severity, with a CVSS score of 6.1, published 13 May 2026.
Which products and versions are affected?
Google SSR >= 19.0.0-next.0, < 19.2.25; >= 20.0.0-next.0, < 20.3.25; >= 21.0.0-next.0, < 21.2.9; >= 22.0.0-next.0, < 22.0.0-next.7, >= 22.0.0-next.0, < 22.0.0-next.7; >= 21.0.0-next.0, < 21.2.9; >= 20.0.0-next.0, < 20.3.25; >= 19.0.0-next.0, < 19.2.25; @angular/ssr (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.7.
Is there a fix for CVE-2026-44437?
Yes. @angular/ssr (npm): upgrade to 22.0.0-next.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44437 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44437?
Check whether you run Google SSR or @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/ssr (npm): upgrade to 22.0.0-next.7 or later
    npm install @angular/ssr@22.0.0-next.7

Technical details

A path traversal vulnerability exists in Angular SSR's processing of the X-Forwarded-Prefix header. The internal validation mechanism fails to account for URL-encoded dots (%2e%2e), allowing attackers to bypass security filters when the application is configured to trust proxy headers. If an application is deployed behind a proxy that forwards unsanitized headers, an attacker can inject traversal sequences. This results in two primary impacts: Open Redirects, where decoded payloads manipulate the Location header during router redirects, and Server-Side Request Steering, where the manipulated prefix is used as a base path for server-side HttpClient requests to unintended endpoints. The issue is fixed in versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 by introducing a trustProxyHeaders option for safer sanitization.

Affected products

  • Angular @angular/ssr 19.0.0-next.0 to < 19.2.25, 20.0.0-next.0 to < 20.3.25, 21.0.0-next.0 to < 21.2.9, 22.0.0-next.0 to < 22.0.0-next.7

Identifiers

  • CVE-2026-44437
  • GHSA-69xr-m8h6-h664

Timeline

  • 2026-04-24: patched: Fix merged into Angular CLI repository
  • 2026-04-30: advisory: GitHub Security Advisory published
  • 2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.