p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de @angular/ssr

Vulnerabilidades publicadas para @angular/ssr en los últimos 30 días: 1. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 7

  1. CVE-2026-104871

    Media · CVSS 6.3EPSS 0,42%Corrección disponible

    Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

    The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester c

    @angular/ssr @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 20.3.36
    • Actualiza a 21.2.23
    • Actualiza a 22.1.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-44437

    Media · CVSS 6.9EPSS 0,3%Corrección disponible

    Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

    The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic. When an Angular SSR application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Pref

    @angular/ssr @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 19.2.25
    • Actualiza a 20.3.25
    • Actualiza a 21.2.9
    • Actualiza a 22.0.0-next.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-33397

    Media · CVSS 6.9EPSS 0,34%Corrección disponible

    Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass

    The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in `@angular/ssr` due to an incomplete fix for CVE-2026-27738. While the original fix successfully blocked multiple leading slashes (e.g., `///`), the internal validation logic fails to account for a single backslash (`\`) bypass. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header, an attacker provides a value starting with a single backslash, the internal validat

    @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 20.3.21
    • Actualiza a 21.2.3
    • Actualiza a 22.0.0-next.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-27739

    Crítica · CVSS 9.2EPSS 0,58%Código de explotación públicoCorrección disponible

    Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

    The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the destination domain. Specifically, the framework didn't have checks for the host domain, path and character sanitization, and port validation. This vulnerabil

    @angular/ssr @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 19.2.21
    • Actualiza a 20.3.17
    • Actualiza a 21.1.5
    • Actualiza a 21.2.0-rc.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-27738

    Media · CVSS 6.9EPSS 0,58%Corrección disponible

    Angular SSR has an Open Redirect via X-Forwarded-Prefix

    The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header, an attacker can provide a value starting with three slashes. This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking.

    @angular/ssr @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 19.2.21
    • Actualiza a 20.3.17
    • Actualiza a 21.1.5
    • Actualiza a 21.2.0-rc.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2025-62427

    Alta · CVSS 8.7EPSS 0,43%Corrección disponible

    Server-Side Request Forgery (SSRF) in Angular SSR

    The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL

    @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 19.2.18
    • Actualiza a 20.3.6
    • Actualiza a 21.0.0-next.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2025-59052

    Alta · CVSS 7.1EPSS 0,36%Corrección disponible

    Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response heade

    @angular/ssr @angular/ssr @angular/ssr @angular/ssrNode.js
    • Actualiza a 18.2.21
    • Actualiza a 19.2.16
    • Actualiza a 20.3.0
    • Actualiza a 21.0.0-next.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →