GHSA-xh43-g2fq-wjrj
NoneCVSS
—
EPSS
—
Published
Feb 25, 2026
CISA due date
—
The record
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/ssr | 19.0.0-next.0 | 19.2.21 |
| npm | @angular/ssr | 20.0.0-next.0 | 20.3.17 |
| npm | @angular/ssr | 21.0.0-next.0 | 21.1.5 |
| npm | @angular/ssr | 21.2.0-next.0 | 21.2.0-rc.1 |
Related vulnerabilities
- CVE-2026-27738 The Angular SSR is a server-rise rendering tool for Angular applications. Same vulnerability
- CVE-2026-33397 The Angular SSR is a server-rise rendering tool for Angular applications. Same vulnerability
- CVE-2026-44437 The Angular SSR is a server-rise rendering tool for Angular applications. Also affects @angular/ssr
- GHSA-69xr-m8h6-h664 Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix Also affects @angular/ssr
- GHSA-vfx2-hv2g-xj5f Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR Also affects @angular/ssr
- GHSA-x288-3778-4hhx Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline Also affects @angular/ssr
- CVE-2026-27739 The Angular SSR is a server-rise rendering tool for Angular applications. Also affects @angular/ssr
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601