Path Traversal Vulnerability in Angular SSR by Angular
CVE-2026-44437
What is CVE-2026-44437?
A vulnerability exists in the header processing logic of Angular SSR (Server-Side Rendering) for specific versions. This issue arises from inadequate validation of the X-Forwarded-Prefix header, which fails to properly handle URL-encoded characters such as dots (%2e%2e). This flaw allows attackers to exploit the system by injecting encoded path traversal sequences. If an Angular SSR application trusts proxy headers and is deployed behind a proxy that forwards this unfiltered header, attackers can craft malicious payloads (e.g., /%2e%2e/evil) to bypass security measures. The vulnerability is effectively mitigated in versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7.
Affected Version(s)
angular-cli >= 22.0.0-next.0, < 22.0.0-next.7 < 22.0.0-next.0, 22.0.0-next.7
angular-cli >= 21.0.0-next.0, < 21.2.9 < 21.0.0-next.0, 21.2.9
angular-cli >= 20.0.0-next.0, < 20.3.25 < 20.0.0-next.0, 20.3.25