Server-Side Rendering Vulnerability in Angular Framework
CVE-2026-111754
What is CVE-2026-111754?
A security flaw in the Angular framework's server-side rendering component, ServerPlatformLocation, allows attackers to manipulate URL normalization. Prior to specified versions, a mishandled request path containing a popping dot segment followed by multiple slashes can lead to improper resolution of the URL. This could result in the inclusion of an attacker-controlled location in the HTTP Location header when there is a mismatch with the router's final location. Subsequently, this vulnerability poses a risk to applications using @angular/platform-server and @angular/ssr, particularly if they expose certain route parameters or user-controlled navigation targets.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.33 < 20.0.0, 20.3.33
angular >= 21.0.0, < 21.2.25 < 21.0.0, 21.2.25