Read the docs
TI-2026-22098 Aliases CVE-2026-27738GHSA-xh43-g2fq-wjrj

Angular SSR has an Open Redirect via X-Forwarded-Prefix

Priority HIGH 70CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header, an attacker can provide a value starting with three slashes. This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking. In order to be vulnerable, the application must use Angular SSR, the application must have routes that perform internal redirects, the infrastructure (Reverse Proxy/CDN) must pass the `X-Forwarded-Prefix` header to the SSR process without sanitization, and the cache must not vary on the `X-Forwarded-Prefix` header. Versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 contain a patch. Until the patch is applied, developers should sanitize the `X-Forwarded-Prefix` header in their`server.ts` before the Angular engine processes the request.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed angular-cli (angular): 21.2.0-rc.0, 21.1.5, 20.3.17 +1@angular/ssr (npm): 21.2.0-rc.1, 21.1.5, 20.3.17 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular-cli21.2.0-next.2 to before 21.2.0-rc.0; 21.0.0-next.0 to before 21.1.5; 20.0.0-next.0 to before 20.3.17; 19.0.0-next.0 to before 19.2.2121.2.0-rc.0, 21.1.5, 20.3.17, 19.2.21Patch availableCNA
—@angular/ssr (npm)21.2.0-next.0 to before 21.2.0-rc.121.2.0-rc.1Patch availableGHSA-xh43-g2fq-wjrj
—@angular/ssr (npm)21.0.0-next.0 to before 21.1.521.1.5Patch availableGHSA-xh43-g2fq-wjrj
—@angular/ssr (npm)20.0.0-next.0 to before 20.3.1720.3.17Patch availableGHSA-xh43-g2fq-wjrj
—@angular/ssr (npm)19.0.0-next.0 to before 19.2.2119.2.21Patch availableGHSA-xh43-g2fq-wjrj
  • angular-cli Vendorangular Affected 21.2.0-next.2 to before 21.2.0-rc.0; 21.0.0-next.0 to before 21.1.5; 20.0.0-next.0 to before 20.3.17; 19.0.0-next.0 to before 19.2.21 Fixed in 21.2.0-rc.0, 21.1.5, 20.3.17, 19.2.21 Patch available CNA
  • @angular/ssr (npm) Vendor— Affected 21.2.0-next.0 to before 21.2.0-rc.1 Fixed in 21.2.0-rc.1 Patch available GHSA-xh43-g2fq-wjrj
  • @angular/ssr (npm) Vendor— Affected 21.0.0-next.0 to before 21.1.5 Fixed in 21.1.5 Patch available GHSA-xh43-g2fq-wjrj
  • @angular/ssr (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.17 Fixed in 20.3.17 Patch available GHSA-xh43-g2fq-wjrj
  • @angular/ssr (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.21 Fixed in 19.2.21 Patch available GHSA-xh43-g2fq-wjrj

Remediation

  • Fix · CNA angular-cli (angular) Fixed in 21.2.0-rc.0, 21.1.5, 20.3.17, 19.2.21
  • Fix · GHSA-xh43-g2fq-wjrj @angular/ssr (npm) Fixed in 21.2.0-rc.1 Advisory →
  • Fix · GHSA-xh43-g2fq-wjrj @angular/ssr (npm) Fixed in 21.1.5 Advisory →
  • Fix · GHSA-xh43-g2fq-wjrj @angular/ssr (npm) Fixed in 20.3.17 Advisory →
  • Fix · GHSA-xh43-g2fq-wjrj @angular/ssr (npm) Fixed in 19.2.21 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27738
  2. 2026-10-03 Alias added: GHSA-xh43-g2fq-wjrj

References

Advisory 1

Other 6

  • TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences