MEDIUM GitHub
CVE-2026-111754
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.
When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.
When a request URL includes a popping dot-segment followed by
Affected Products
- npm/@angular/platform-server >= 22.0.0, < 22.2.1
- npm/@angular/platform-server >= 21.0.0, < 21.2.25
- npm/@angular/platform-server >= 20.0.0, < 20.3.33
- npm/@angular/platform-server <= 19.2.25
References
- https://github.com/advisories/GHSA-w739-gvwx-grc3
- https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3
- https://github.com/angular/angular/pull/71077
- https://github.com/angular/angular/pull/71078
This medium severity vulnerability was published on 2026-10-20 via GitHub. Affected: npm/@angular/platform-server >= 22.0.0, < 22.2.1, npm/@angular/platform-server >= 21.0.0, < 21.2.25, npm/@angular/platform-server >= 20.0.0, < 20.3.33 and 1 more.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.