CVE-2026-111754

What it actually does

Bypasses raw resolveUrl check in ServerPlatformLocation allowing a crafted request path with dot segments and multiple slashes to normalize to a double-slash pathname that is placed in an HTTP Location header, resulting in an open redirect to an attacker-controlled origin during Angular SSR mismatch handling.

Why it matters to the business

Attackers can redirect users to malicious sites, enabling phishing or credential theft that erodes customer trust and may trigger regulatory scrutiny for organizations using affected Angular SSR applications.

How an attack unfolds

An attacker crafts a request path containing a popping dot segment followed by multiple slashes that survives the pre-normalization check; the SSR router mismatch then emits the normalized double-slash pathname in a Location header, causing the browser to navigate to an attacker origin when the application exposes parameter or child routes or forwards user-controlled targets.

How to fix it

Upgrade @angular/platform-server and @angular/ssr to versions 20.3.33, 21.2.25, or 22.2.1. Review any custom navigation or route-handling code that preserves dot segments or semicolons and remove or sanitize user-controlled targets before SSR processing.

How to confirm the fix worked

Confirm installed package versions meet or exceed the fixed releases; replay known bypass payloads against upgraded instances and verify that double-slash Location headers are no longer produced.

Typical attack path

1. Identify an Angular SSR application using @angular/platform-server or @angular/ssr with compatible route shapes.
2. Craft a request containing a dot-segment sequence followed by multiple slashes that bypasses the resolveUrl guard.
3. Trigger SSR navigation so the final location mismatches and the double-slash pathname is emitted in the Location header.
4. Victim browser follows the header to the attacker-controlled origin.

How to detect it

Inspect web server and application logs for requests containing dot segments immediately followed by multiple slashes that result in Location headers beginning with two slashes; correlate with SSR navigation mismatch events in Angular platform-server logs.

• ..//
• Location: //
• normalize.*//

What your security team should do

• Immediately inventory all Angular SSR deployments and schedule upgrades to the fixed versions within the next sprint.
• Add automated dependency scanning to CI pipelines to block future vulnerable Angular SSR releases.
• Temporarily disable or sanitize any user-controlled navigation targets passed through SSR infrastructure until upgrades are complete.