CVE-2026-44437: Angular SSR Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Angular SSR (Server-Side Rendering) is a powerful feature of the Angular framework that allows developers to render applications on the server, improving performance and SEO. It processes requests and serves pre-rendered pages to clients, enhancing user experience. However, vulnerabilities in its handling of proxy headers can expose applications to significant security risks, particularly when misconfigured.

Vulnerability Detail

A vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic. The vulnerability can lead to two main issues: Open Redirect, where the application processes a redirect to an unintended path or external domain, and Server-Side Request Steering, where the manipulated prefix is used as the base path for server-side HttpClient requests, causing the server to make requests to unintended internal paths or external endpoints.

npm install @angular/ssr@22.2.4

Workaround

Until the patch is applied, developers should manually sanitize the X-Forwarded-Prefix header in their server.ts file. The following code snippet demonstrates how to implement this workaround:

app.use((req, res, next) => {
  let prefix = req.headers['x-forwarded-prefix'];
  if (Array.isArray(prefix)) prefix = prefix[0];

  if (prefix) {

try {

      const decodedPrefix = decodeURIComponent(prefix);

  req.headers['x-forwarded-prefix'] = decodedPrefix
    .replace(/\.\.\/g, '')
    .

replace(/^[\/\\]+\//, '/');

} catch (e) {
      delete req.headers['x-forwarded-prefix'];
    }
  }

next();

});

Conclusion

The vulnerability CVE-2026-44437 in Angular SSR poses significant security risks due to improper handling of the X-Forwarded-Prefix header. It is crucial for developers to update to the patched versions of the package and implement the recommended workarounds to safeguard their applications.

See every vulnerability recorded for @angular/ssr →

FAQ