CVE-2026-27738: Open Redirect Vulnerability in @angular/ssr

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The @angular/ssr package is a server-side rendering solution for Angular applications, enabling developers to render Angular applications on the server and serve them to clients. This enhances performance and SEO capabilities by delivering fully rendered pages to users. However, a vulnerability has been identified that compromises the security of applications using this package when deployed behind certain proxy configurations.

Vulnerability Detail

An Open Redirect vulnerability exists in the internal URL processing logic of Angular SSR. This issue arises from the way the application normalizes URL segments by stripping leading slashes, but only removes a single leading slash. When deployed behind a proxy that forwards the 'X-Forwarded-Prefix' header, an attacker can manipulate this header to include multiple leading slashes (e.g., '///evil.com'). The application processes this as a redirect, leading to a protocol-relative URL that redirects users to a malicious site. This vulnerability can lead to phishing attacks and SEO hijacking, as it allows attackers to poison high-traffic routes and potentially harm the reputation of the legitimate site.

npm install @angular/ssr@22.2.4

Workaround

Until the patch is applied, developers should sanitize the 'X-Forwarded-Prefix' header in their server.ts file before the Angular engine processes the request. Here is a code snippet to implement this workaround:

app.use((req, res, next) => {
  const prefix = req.headers['x-forwarded-prefix']?.trim();
  if (prefix) {
    // Sanitize by removing all leading slashes
    req.headers['x-forwarded-prefix'] = prefix.replace(/^[\/\\]+/, '/');
  }
  next();
});

Conclusion

The Open Redirect vulnerability in @angular/ssr poses significant risks to applications using this package, particularly when deployed behind certain proxy configurations. It is crucial to apply the available patches or implement the suggested workarounds to mitigate these risks.

See every vulnerability recorded for @angular/ssr →

FAQ