{"id":"EUVD-2026-116377","revision":"ae447b1a8d34468a9a808fbff1a351fb","records":[{"revision":"ae447b1a8d34468a9a808fbff1a351fb","observedAt":"2026-11-05T04:01:04.869+00:00","statement":{"source":"euvd","id":"EUVD-2026-116377","aliases":["CVE-2026-111754","GHSA-w739-gvwx-grc3"],"title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for pr…","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":null}],"references":["https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3","https://github.com/angular/angular/issues/71076","https://github.com/angular/angular/pull/71077","https://github.com/angular/angular/pull/71078","https://github.com/angular/angular/pull/71079","https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a","https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262","https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116377","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 3, 2026, 8:55:11 PM","dateUpdated":"Nov 3, 2026, 9:23:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-116377","identifiers":["EUVD-2026-116377","CVE-2026-111754","GHSA-w739-gvwx-grc3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}