CVE-2026-104871: Path Traversal Vulnerability in @angular/ssr Leading to Unauthorized Access
Summary
CVE-2026-104871: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows. Affects @angular/ssr across 4 version ranges.
< 19.2.27
>= 20.0.0, < 20.3.36
>= 21.0.0, < 21.2.23
>= 22.0.0, < 22.1.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/ssr package is a server-side rendering engine for Angular applications, enabling developers to generate static HTML pages for improved performance and SEO. This package is widely used in web applications to enhance user experience by pre-rendering content. However, a specific vulnerability has been identified that affects the prerendered page retrieval logic, particularly on Windows systems.
Vulnerability Detail
A Path Traversal vulnerability exists in the prerendered page retrieval logic of CommonEngine in @angular/ssr. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences, allowing unauthorized access to prerendered static pages from sibling directories. This vulnerability arises from improper handling of relative URLs and Windows file paths, leading to potential information disclosure of sensitive HTML pages.
How To Fix
Latest published version: 22.2.4 as of 22 Oct 2026
npm install @angular/ssr@22.2.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2719.2.27npm install @angular/ssr@19.2.27 -
>= 20.0.0, < 20.3.3620.3.36npm install @angular/ssr@20.3.36 -
>= 21.0.0, < 21.2.2321.2.23npm install @angular/ssr@21.2.23 -
>= 22.0.0, < 22.1.722.1.7npm install @angular/ssr@22.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until a patch is applied, developers can sanitize request URLs in the server.ts file before passing them to CommonEngine.render. Here is a code snippet to normalize backslashes or construct a full HTTP URL:
server.use((req, res, next) => {
const { protocol, originalUrl, headers } = req;
// Normalize backslashes or construct a full HTTP URL
const sanitizedUrl = `${protocol}://$ {headers.host}${originalUrl.replace(/\\/g, '/')}`;
commonEngine
.render({
bootstrap,
documentFilePath: indexHtml,
url: sanitizedUrl,
publicPath: distFolder,
})
.then((html) => res.send(html))
.catch((err) => next(err));
});
Conclusion
The Path Traversal vulnerability in @angular/ssr poses a significant risk to applications running on Windows, allowing unauthorized access to sensitive prerendered pages. It is crucial to update to the latest patched versions or implement the suggested workarounds to mitigate this risk.
See every vulnerability recorded for @angular/ssr →
FAQ
The vulnerability is a Path Traversal issue that allows unauthorized access to prerendered HTML pages from sibling directories on Windows systems.
Affected versions include >= 22.0.0, < 22.1.7; >= 21.0.0, < 21.2.23; >= 20.0.0, < 20.3.36; and <= 19.2.27.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to information disclosure of sensitive prerendered HTML pages, which may contain internal application data.
Implement the provided workaround to sanitize request URLs until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/ssr.
