6.9

CVE-2026-44437

Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic.
When an Angular SSR application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Prefix header without prior sanitization, an attacker can provide a payload such as /%2e%2e/evil. This vulnerability is fixed in19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Angular ≫ Angular Cli SwPlatformnode.js Version >= 19.0.0 < 19.2.25
Angular ≫ Angular Cli SwPlatformnode.js Version >= 20.0.0 < 20.3.25
Angular ≫ Angular Cli SwPlatformnode.js Version >= 21.0.0 < 21.2.9
Angular ≫ Angular Cli Version22.0.0 Updatenext0 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext1 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext2 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext3 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext4 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext5 SwPlatformnode.js
Angular ≫ Angular Cli Version22.0.0 Updatenext6 SwPlatformnode.js
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.102
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://github.com/angular/angular-cli/security/advisories/GHSA-69xr-m8h6-h664
Vendor Advisory
https://github.com/angular/angular-cli/pull/33031
Patch