CVE-2026-111754 · GHSA-w739-gvwx-grc3

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Risk score: 48/100
CVSS: 5.1 v4.0
Exploit chance (30 days): 1.0%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing…
Affected: @angular/platform-server (npm) >= 22.0.0, < 22.2.1; @angular/platform-server (npm) >= 21.0.0, < 21.2.25; @angular/platform-server (npm) >= 20.0.0, < 20.3.33; @angular/platform-server (npm) <= 19.2.25
Fix: Upgrade @angular/platform-server to 22.2.1 or 21.2.25 or 20.3.33 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@angular/platform-server: Amber, patch this week. Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-contr…

The flaws

CVE-2026-111754: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) (CVSS 5.1 · EPSS 1%)
CVE-2026-101895: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVSS 8.7 · EPSS 1%)
CVE-2026-88058: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (CVSS 8.6 · EPSS 0%)

The fix

Upgrade @angular/platform-server: 20.3.33 · 21.2.25 · 22.2.1 · 20.3.31 · 21.2.23 · 22.1.6 or later on your release line

Who is exposed: @angular/platform-server (npm) >= 22.0.0, < 22.1.6; @angular/platform-server (npm) >= 21.0.0, < 21.2.23; @angular/platform-server (npm) >= 20.0.0, < 20.3.31; @angular/platform-server (npm) <= 19.2.25

Where it stands

Public proof of concept

Connects to

Same weakness: Open redirect (CWE-601). 35 other warnings in 30 days

Why it is Yellow

CVSS 5.1 medium
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@angular/platform-server	npm	>= 22.0.0, < 22.2.1	22.2.1
@angular/platform-server	npm	>= 21.0.0, < 21.2.25	21.2.25
@angular/platform-server	npm	>= 20.0.0, < 20.3.33	20.3.33
@angular/platform-server	npm	<= 19.2.25	No fix yet

References

Original description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Last activity 3 Nov 2026. Patch Forecast updates every hour.