GHSA-69xr-m8h6-h664
NoneCVSS
—
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/ssr | 19.0.0-next.0 | 19.2.25 |
| npm | @angular/ssr | 20.0.0-next.0 | 20.3.25 |
| npm | @angular/ssr | 21.0.0-next.0 | 21.2.9 |
| npm | @angular/ssr | 22.0.0-next.0 | 22.0.0-next.7 |
Related vulnerabilities
- CVE-2026-44437 The Angular SSR is a server-rise rendering tool for Angular applications. Same vulnerability
- CVE-2026-33397 The Angular SSR is a server-rise rendering tool for Angular applications. Also affects @angular/ssr
- GHSA-vfx2-hv2g-xj5f Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR Also affects @angular/ssr
- GHSA-x288-3778-4hhx Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline Also affects @angular/ssr
- GHSA-xh43-g2fq-wjrj Angular SSR has an Open Redirect via X-Forwarded-Prefix Also affects @angular/ssr
- CVE-2026-27739 The Angular SSR is a server-rise rendering tool for Angular applications. Also affects @angular/ssr
- CVE-2026-27738 The Angular SSR is a server-rise rendering tool for Angular applications. Also affects @angular/ssr
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22