Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic. When an Angular SSR application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Prefix header without prior sanitization, an attacker can provide a payload such as /%2e%2e/evil. This vulnerability is fixed in19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix Fixed angular-cli (angular): 22.0.0-next.7, 21.2.9, 20.3.25 +1@angular/ssr (npm): 22.0.0-next.7, 21.2.9, 20.3.25 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular-cli | 22.0.0-next.0 to before 22.0.0-next.7; 21.0.0-next.0 to before 21.2.9; 20.0.0-next.0 to before 20.3.25; 19.0.0-next.0 to before 19.2.25 | 22.0.0-next.7, 21.2.9, 20.3.25, 19.2.25 | Patch available | CNA |
| — | @angular/ssr (npm) | 22.0.0-next.0 to before 22.0.0-next.7 | 22.0.0-next.7 | Patch available | GHSA-69xr-m8h6-h664 |
| — | @angular/ssr (npm) | 21.0.0-next.0 to before 21.2.9 | 21.2.9 | Patch available | GHSA-69xr-m8h6-h664 |
| — | @angular/ssr (npm) | 20.0.0-next.0 to before 20.3.25 | 20.3.25 | Patch available | GHSA-69xr-m8h6-h664 |
| — | @angular/ssr (npm) | 19.0.0-next.0 to before 19.2.25 | 19.2.25 | Patch available | GHSA-69xr-m8h6-h664 |
- angular-cli Vendorangular Affected 22.0.0-next.0 to before 22.0.0-next.7; 21.0.0-next.0 to before 21.2.9; 20.0.0-next.0 to before 20.3.25; 19.0.0-next.0 to before 19.2.25 Fixed in 22.0.0-next.7, 21.2.9, 20.3.25, 19.2.25 Patch available CNA
- @angular/ssr (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-next.7 Fixed in 22.0.0-next.7 Patch available GHSA-69xr-m8h6-h664
- @angular/ssr (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.9 Fixed in 21.2.9 Patch available GHSA-69xr-m8h6-h664
- @angular/ssr (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.25 Fixed in 20.3.25 Patch available GHSA-69xr-m8h6-h664
- @angular/ssr (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.25 Fixed in 19.2.25 Patch available GHSA-69xr-m8h6-h664
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular_cli:*:*:*:*:*:node.js:*:* | 19.0.0 to before 19.2.25; 20.0.0 to before 20.3.25; 21.0.0 to before 21.2.9 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:node.js:*:* | 22.0.0 next0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:node.js:*:* | 22.0.0 next1 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next2:*:*:*:node.js:*:* | 22.0.0 next2 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next3:*:*:*:node.js:*:* | 22.0.0 next3 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next4:*:*:*:node.js:*:* | 22.0.0 next4 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next5:*:*:*:node.js:*:* | 22.0.0 next5 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next6:*:*:*:node.js:*:* | 22.0.0 next6 | Vulnerable | angular |
- cpe:2.3:a:angular:angular_cli:*:*:*:*:*:node.js:*:* Versions 19.0.0 to before 19.2.25; 20.0.0 to before 20.3.25; 21.0.0 to before 21.2.9 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:node.js:*:* Versions 22.0.0 next0 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:node.js:*:* Versions 22.0.0 next1 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next2:*:*:*:node.js:*:* Versions 22.0.0 next2 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next3:*:*:*:node.js:*:* Versions 22.0.0 next3 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next4:*:*:*:node.js:*:* Versions 22.0.0 next4 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next5:*:*:*:node.js:*:* Versions 22.0.0 next5 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next6:*:*:*:node.js:*:* Versions 22.0.0 next6 Vulnerable ·angular
Remediation
- Fix · CNA angular-cli (angular) Fixed in 22.0.0-next.7, 21.2.9, 20.3.25, 19.2.25
- Fix · GHSA-69xr-m8h6-h664 @angular/ssr (npm) Fixed in 22.0.0-next.7 Advisory →
- Fix · GHSA-69xr-m8h6-h664 @angular/ssr (npm) Fixed in 21.2.9 Advisory →
- Fix · GHSA-69xr-m8h6-h664 @angular/ssr (npm) Fixed in 20.3.25 Advisory →
- Fix · GHSA-69xr-m8h6-h664 @angular/ssr (npm) Fixed in 19.2.25 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44437
- 2026-10-03 Alias added: GHSA-69xr-m8h6-h664
References
Advisory 2
More Angular Cli vulnerabilities
- TI-2026-25144 Angular has XSS in i18n attribute bindings CVSS 4.0HIGH 8.6
- TI-2026-25794 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-44437 · CVE Program
- CVE-2026-44437 · NVD
- FIRST EPSS
- GHSA-69xr-m8h6-h664 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences