Executive brief
Angular SSR, a tool used to speed up web applications by rendering pages on the server, contains a vulnerability in how it handles specific web traffic headers. An attacker can use specially crafted web requests to trick the server into redirecting users to malicious websites or making unauthorized internal network requests. This could lead to users being phished or the exposure of internal services not intended for public access.
Technical details
A path traversal vulnerability exists in Angular SSR's processing of the X-Forwarded-Prefix header. The internal validation mechanism fails to account for URL-encoded dots (%2e%2e), allowing attackers to bypass security filters when the application is configured to trust proxy headers. If an application is deployed behind a proxy that forwards unsanitized headers, an attacker can inject traversal sequences. This results in two primary impacts: Open Redirects, where decoded payloads manipulate the Location header during router redirects, and Server-Side Request Steering, where the manipulated prefix is used as a base path for server-side HttpClient requests to unintended endpoints. The issue is fixed in versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 by introducing a trustProxyHeaders option for safer sanitization.
Affected products
- Angular @angular/ssr 19.0.0-next.0 to < 19.2.25, 20.0.0-next.0 to < 20.3.25, 21.0.0-next.0 to < 21.2.9, 22.0.0-next.0 to < 22.0.0-next.7
Timeline
- 2026-04-24: patched: Fix merged into Angular CLI repository
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD