CVE-2026-111754: Open Redirect Vulnerability in @angular/platform-server via Protocol-Relative URLs

Background

The @angular/platform-server package is a core component of the Angular framework, enabling Server-Side Rendering (SSR) for Angular applications. This functionality allows web applications to render content on the server before sending it to the client, improving performance and SEO. However, a vulnerability has been identified that could allow attackers to exploit SSR features to redirect users to malicious external sites.

Vulnerability Detail

An open redirect vulnerability exists in @angular/platform-server when SSR is enabled. The issue arises from the way the ServerPlatformLocation handles URL resolution. Specifically, the method resolveUrl (or parseUrl in version 20) improperly processes protocol-relative URLs. It fails to reject certain malformed URLs that include dot-segments followed by slashes, allowing attackers to craft URLs that redirect users to arbitrary external domains. This can lead to unauthorized access and phishing attacks, as users may be misled into visiting malicious sites.

npm install @angular/platform-server@22.2.3

Workaround

If immediate upgrading is not feasible, consider implementing the following workaround at your edge reverse proxy or Web Application Firewall (WAF):

1. Reject Paths with Dot-Segments Followed by Slashes: Configure your reverse proxy (e.g., Nginx) to block requests containing suspicious path normalization sequences. Here is an example configuration:

   # Nginx example: reject suspicious path normalization sequences
   if ($request_uri ~* "(\n/\.\/|\/\.\;)") {
       return 400;
   }
   

Conclusion

The open redirect vulnerability in @angular/platform-server poses a significant risk to applications utilizing Server-Side Rendering. It is crucial to update to the latest patched versions to ensure the security of your application. If immediate updates are not possible, applying the recommended workarounds can help mitigate potential risks.

See every vulnerability recorded for @angular/platform-server →

FAQ