CVE-2026-104871
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Angular SSR is a server-side rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. An unauthenticated requester can retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker.
Risk Assessment
This may lead to unauthorized access to certain prerendered pages, potentially exposing information, but does not provide arbitrary file read.
Recommendation
Update Angular SSR to version 20.3.36, 21.2.23, or 22.1.7 (or later), which fix this vulnerability.
Other vulnerabilities in Angular SSR
See all- CVE-2026-27739Critical
Angular SSR before versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 has a Server-Side Request Forgery (SSRF) vulnerability in request handling. The framework trusts user-controlled Host and X-Forwarded-* headers without validation, allowing attackers to direct requests to internal resources.
- CVE-2026-44437Medium
Vulnerability in Angular SSR from 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 in X-Forwarded-Prefix header processing. The validation mechanism fails to account for URL-encoded characters, specifically dots (%2e%2e), allowing bypass of security filters via encoded path traversal sequences.
- CVE-2025-62427High
Angular SSR (package @angular/ssr) before versions 19.2.18, 20.3.6, and 21.0.0-next.8 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL resolution mechanism. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\), the URL constructor treats it as a schema-relative URL, overriding the security-intended base URL (protocol, host, and port) and adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.
Original NVD description (English source)
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS