TI-2026-84799 Aliases CVE-2026-111754

Open redirect in Angular SSR via protocol-relative URLs

LOW 25CWE-601Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: None · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

Angular through 19.2.25, from 20.0.0 before 20.3.33, from 21.0.0 before 21.2.25 and from 22.0.0 before 22.2.1 are affected. Server-side rendering checks for protocol-relative URLs before URL normalization, so a crafted request path can bypass the check (CWE-601). A remote attacker can make the server send a Location header that redirects browsers to an attacker-controlled origin.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00977 62nd percentileScored 2026-11-07

Fix Partial angular (angular): 20.3.33, 21.2.25, 22.2.1@angular/platform-server (npm): 22.2.1, 21.2.25, 20.3.33Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
angular	angular	up to 19.2.25; 20.0.0 to before 20.3.33; 21.0.0 to before 21.2.25; 22.0.0 to before 22.2.1	20.3.33, 21.2.25, 22.2.1	Patch available	CNA
—	@angular/platform-server (npm)	22.0.0 to before 22.2.1	22.2.1	Patch available	GHSA-w739-gvwx-grc3
—	@angular/platform-server (npm)	21.0.0 to before 21.2.25	21.2.25	Patch available	GHSA-w739-gvwx-grc3
—	@angular/platform-server (npm)	20.0.0 to before 20.3.33	20.3.33	Patch available	GHSA-w739-gvwx-grc3
—	@angular/platform-server (npm)	up to 19.2.25	—	No fix listed	GHSA-w739-gvwx-grc3

angular Vendorangular Affected up to 19.2.25; 20.0.0 to before 20.3.33; 21.0.0 to before 21.2.25; 22.0.0 to before 22.2.1 Fixed in 20.3.33, 21.2.25, 22.2.1 Patch available CNA
@angular/platform-server (npm) Vendor— Affected 22.0.0 to before 22.2.1 Fixed in 22.2.1 Patch available GHSA-w739-gvwx-grc3
@angular/platform-server (npm) Vendor— Affected 21.0.0 to before 21.2.25 Fixed in 21.2.25 Patch available GHSA-w739-gvwx-grc3
@angular/platform-server (npm) Vendor— Affected 20.0.0 to before 20.3.33 Fixed in 20.3.33 Patch available GHSA-w739-gvwx-grc3
@angular/platform-server (npm) Vendor— Affected up to 19.2.25 Fixed in — No fix listed GHSA-w739-gvwx-grc3

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:angular:angular::::::::	—	—	angular

cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:* Versions — — ·angular

Remediation

Upgrade Angular to 20.3.33, 21.2.25 or 22.2.1, and upgrade @angular/platform-server to 20.3.33, 21.2.25 or 22.2.1. The sources list no fixed version for @angular/platform-server in releases through 19.2.25. Red Hat rates this Moderate and lists Red Hat Enterprise Linux 8 as affected without a fix, with plan none available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA angular (angular) Fixed in 20.3.33, 21.2.25, 22.2.1
Fix · GHSA-w739-gvwx-grc3 @angular/platform-server (npm) Fixed in 22.2.1 Advisory →
Fix · GHSA-w739-gvwx-grc3 @angular/platform-server (npm) Fixed in 21.2.25 Advisory →
Fix · GHSA-w739-gvwx-grc3 @angular/platform-server (npm) Fixed in 20.3.33 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred

Timeline

2026-11-03 Threatist record created from CVE-2026-111754
2026-11-03 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Other 13

TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences