CVE-2026-33397Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
Updated under an hour ago ()
Does this affect you?
It affects angular-cli and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in `@angular/ssr` due to an incomplete fix for CVE-2026-27738. While the original fix successfully blocked multiple leading slashes (e.g., `///`), the internal validation logic fails to account for a single backslash (`\`) bypass. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header, an attacker provides a value starting with a single backslash, the internal validation failed to flag the single backslash as invalid, the application prepends a leading forward slash, resulting in a `Location` header containing the URL, and modern browsers interpret the `/\` sequence as `//`, treating it as a protocol-relative URL and redirecting the user to the attacker-controlled domain. Furthermore, the response lacks the `Vary: X-Forwarded-Prefix` header, allowing the malicious redirect to be stored in intermediate caches (Web Cache Poisoning). Versions 22.0.0-next.2, 21.2.3, and 20.3.21 contain a patch. Until the patch is applied, developers should sanitize the `X-Forwarded-Prefix` header in their `server.ts` before the Angular engine processes the request.
- CVSS
- 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Weakness (CWE)
- CWE-601
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Mar 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
angular angular-cli angular:cli (from the name) | from 22.0.0-next.0, < 22.0.0-next.2; from 21.0.0-next.0, < 21.2.3; from 20.0.0-next.0, < 20.3.21 | CNA record |
angular angular_cli angular:angular_cli | from 20.0.0 before 20.3.21; from 21.0.0 before 21.2.3; 22.0.0; 22.0.0 | NVD |
References
- https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5fx-refsource-confirm, vendor-advisory
- https://github.com/angular/angular-cli/pull/32771x-refsource-misc, issue-tracking, patch
- https://github.com/advisories/GHSA-xh43-g2fq-wjrjx-refsource-misc, not-applicable
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.