# CVE-2026-44437: Angular SSR path traversal in X-Forwarded-Prefix header

Source: https://junglewise.ai/threats/cve-2026-44437-angular-ssr-path-traversal-in-x-forwarded-prefix-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-44437 · Severity: medium · CVSS 6.1 · Published 2026-05-13

Angular SSR, a tool used to speed up web applications by rendering pages on the server, contains a vulnerability in how it handles specific web traffic headers. An attacker can use specially crafted web requests to trick the server into redirecting users to malicious websites or making unauthorized internal network requests. This could lead to users being phished or the exposure of internal services not intended for public access.

Technologies: [Google SSR](https://junglewise.ai/threats/technologies/ssr), [@angular/ssr (npm)](https://junglewise.ai/threats/technologies/angular-ssr). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44437 being exploited in the wild.

**How severe is CVE-2026-44437?** Medium severity, with a CVSS score of 6.1, published 13 May 2026.

**Which products and versions are affected?** Google SSR >= 19.0.0-next.0, < 19.2.25; >= 20.0.0-next.0, < 20.3.25; >= 21.0.0-next.0, < 21.2.9; >= 22.0.0-next.0, < 22.0.0-next.7, >= 22.0.0-next.0, < 22.0.0-next.7; >= 21.0.0-next.0, < 21.2.9; >= 20.0.0-next.0, < 20.3.25; >= 19.0.0-next.0, < 19.2.25; @angular/ssr (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.7.

**Is there a fix for CVE-2026-44437?** Yes. @angular/ssr (npm): upgrade to 22.0.0-next.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44437 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44437?** Check whether you run Google SSR or @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/ssr (npm): upgrade to 22.0.0-next.7 or later

  ```sh
  npm install @angular/ssr@22.0.0-next.7
  ```


## Technical details

A path traversal vulnerability exists in Angular SSR's processing of the X-Forwarded-Prefix header. The internal validation mechanism fails to account for URL-encoded dots (%2e%2e), allowing attackers to bypass security filters when the application is configured to trust proxy headers. If an application is deployed behind a proxy that forwards unsanitized headers, an attacker can inject traversal sequences. This results in two primary impacts: Open Redirects, where decoded payloads manipulate the Location header during router redirects, and Server-Side Request Steering, where the manipulated prefix is used as a base path for server-side HttpClient requests to unintended endpoints. The issue is fixed in versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 by introducing a trustProxyHeaders option for safer sanitization.

## Affected products

- Angular @angular/ssr 19.0.0-next.0 to < 19.2.25, 20.0.0-next.0 to < 20.3.25, 21.0.0-next.0 to < 21.2.9, 22.0.0-next.0 to < 22.0.0-next.7

## Identifiers

- CVE-2026-44437
- GHSA-69xr-m8h6-h664

## Timeline

- 2026-04-24: patched: Fix merged into Angular CLI repository
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD

## References

- [https://github.com/angular/angular-cli/pull/33031](https://github.com/angular/angular-cli/pull/33031)
- [https://github.com/angular/angular-cli/security/advisories/GHSA-69xr-m8h6-h664](https://github.com/angular/angular-cli/security/advisories/GHSA-69xr-m8h6-h664)

## Related threats

- [Angular SSR path traversal via backslash on Windows](https://junglewise.ai/threats/cve-2026-104871-the-angular-ssr-is-a-server-rise-rendering-tool-for-angular)
- [Angular SSR protocol-relative URL injection via backslash bypass](https://junglewise.ai/threats/cve-2026-33397-angular-ssr-protocol-relative-url-injection-via-backslash-bypass)
- [Angular SSR SSRF and header injection in request handling](https://junglewise.ai/threats/cve-2026-27739-angular-ssr-ssrf-and-header-injection-in-request-handling)
- [Angular SSR open redirect via X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-27738-angular-ssr-open-redirect-via-x-forwarded-prefix-header)
- [Angular SSR server-side request forgery in URL resolution](https://junglewise.ai/threats/cve-2025-62427-angular-ssr-server-side-request-forgery-in-url-resolution)