{"id":"EUVD-2026-116377","enisaUuid":"bec0c7c6-5f8d-3e26-b49c-1e02afb1f96a","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router\u0027s final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","datePublished":"Nov 3, 2026, 8:55:11 PM","dateUpdated":"Nov 3, 2026, 9:23:55 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3\nhttps://github.com/angular/angular/issues/71076\nhttps://github.com/angular/angular/pull/71077\nhttps://github.com/angular/angular/pull/71078\nhttps://github.com/angular/angular/pull/71079\nhttps://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a\nhttps://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262\nhttps://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521\nhttps://github.com/angular/angular/releases/tag/v20.3.33\nhttps://github.com/angular/angular/releases/tag/v21.2.25\nhttps://github.com/angular/angular/releases/tag/v22.2.1\n","aliases":"CVE-2026-111754\nGHSA-w739-gvwx-grc3\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"019f429f-4ecf-3d1d-a19e-719c33d97bef","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"93621626-e050-386b-8d7e-92b14d6ca42a","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.33"},{"id":"a1b55ea3-8336-3a7c-a2cb-c500a0299bb1","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.2.1"},{"id":"f912c150-954d-39b0-9f76-21ce42ba0d17","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.25"}],"enisaIdVendor":[{"id":"116cf1ea-758a-33e3-b7d8-7921285c5cbd","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"60c87a89-7f46-3a60-919b-532a56820224","vulnerability":{"id":"GHSA-w739-gvwx-grc3","description":"@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","datePublished":"Oct 20, 2026, 2:35:49 PM","dateUpdated":"Oct 20, 2026, 2:35:49 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3\nhttps://github.com/angular/angular/pull/71077\nhttps://github.com/angular/angular/pull/71078\nhttps://github.com/angular/angular/pull/71079\nhttps://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a\nhttps://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262\nhttps://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521\nhttps://github.com/angular/angular/commit/d7d81e189d227108c3b9d39178dbb7389f6f970d\nhttps://github.com/angular/angular\nhttps://github.com/angular/angular/releases/tag/v20.3.33\nhttps://github.com/angular/angular/releases/tag/v21.2.25\nhttps://github.com/angular/angular/releases/tag/v22.2.1\n","enisa_id":"EUVD-2026-116377\n","aliases":"CVE-2026-111754\nGHSA-w739-gvwx-grc3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f2157e27-7163-3810-a350-8234b3db3ed5","vulnerability":{"id":"CVE-2026-111754","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router\u0027s final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","datePublished":"Nov 3, 2026, 8:55:11 PM","dateUpdated":"Nov 3, 2026, 9:23:55 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3\nhttps://github.com/angular/angular/issues/71076\nhttps://github.com/angular/angular/pull/71077\nhttps://github.com/angular/angular/pull/71078\nhttps://github.com/angular/angular/pull/71079\nhttps://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a\nhttps://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262\nhttps://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521\nhttps://github.com/angular/angular/releases/tag/v20.3.33\nhttps://github.com/angular/angular/releases/tag/v21.2.25\nhttps://github.com/angular/angular/releases/tag/v22.2.1\n","enisa_id":"EUVD-2026-116377\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Nov 5, 2026, 6:00:30 AM","vulnerabilityProduct":[{"id":"990a1c45-91e7-3d8a-a0f9-fbd82e3ab5a1","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"bbdf8f9b-e848-3c1d-b34d-e55c3a6e7bc3","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.2.1"},{"id":"bfb01d99-5614-3b7b-bf34-720d0a2698f1","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.25"},{"id":"eac191b6-0604-3d51-9003-875d52b735b3","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.33"}],"vulnerabilityVendor":[{"id":"5d091b2f-31e8-3dc6-89a6-e8e788c3f113","vendor":{"name":"angular"}}]}}],"enisaIdAdvisory":[]}