CVE-2026-33397: @angular/ssr Protocol-Relative URL Injection Vulnerability
Summary
CVE-2026-33397: Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR. Affects @angular/ssr across 3 version ranges.
>= 20.0.0-next.0, < 20.3.21
>= 21.0.0-next.0, < 21.2.3
>= 22.0.0-next.0, < 22.0.0-next.2
Fixed in 20.3.21, 21.2.3 or 22.0.0-next.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/ssr package is a server-side rendering solution for Angular applications, allowing developers to render Angular applications on the server to improve performance and SEO. However, it is susceptible to a specific vulnerability that can lead to open redirects, potentially compromising user security and trust.
Vulnerability Detail
An Open Redirect vulnerability exists in @angular/ssr due to an incomplete fix for CVE-2026-27738. The internal validation logic fails to account for a single backslash bypass. When deployed behind a proxy that passes the X-Forwarded-Prefix header, an attacker can manipulate this header to inject a malicious URL. This results in a Location header that modern browsers interpret as a protocol-relative URL, redirecting users to an attacker-controlled domain. The lack of a Vary: X-Forwarded-Prefix header allows this malicious redirect to be cached, leading to potential phishing and SEO hijacking.
How To Fix
Latest published version: 22.2.4 as of 22 Oct 2026
npm install @angular/ssr@22.2.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 20.0.0-next.0, < 20.3.2120.3.21npm install @angular/ssr@20.3.21 -
>= 21.0.0-next.0, < 21.2.321.2.3npm install @angular/ssr@21.2.3 -
>= 22.0.0-next.0, < 22.0.0-next.222.0.0-next.2npm install @angular/ssr@22.0.0-next.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until the patch is applied, developers should sanitize the X-Forwarded-Prefix header in their server.ts file before the Angular engine processes the request. Use the following code snippet:
app.use((req, res, next) => {
const prefix = req.headers['x-forwarded-prefix'];
if (typeof prefix === 'string') {
// Sanitize by removing all leading forward and backward slashes
req.headers['x-forwarded-prefix'] = prefix.trim().replace(/^[\/\\]+/, '/');
}
next();
});
Conclusion
CVE-2026-33397 is a significant vulnerability in the @angular/ssr package that can lead to serious security issues such as phishing and SEO hijacking. It is crucial for developers to update to the patched versions or implement the recommended workaround to protect their applications.
See every vulnerability recorded for @angular/ssr →
FAQ
CVE-2026-33397 is a vulnerability in the @angular/ssr package that allows attackers to perform open redirects through a protocol-relative URL injection.
This vulnerability can lead to phishing attacks and SEO hijacking, as attackers can redirect users to malicious sites without raising suspicion.
Versions prior to 22.0.0-next.2, 21.2.3, and 20.3.21 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/ssr.
