CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Attackers can bypass security filters via encoded path traversal in X-Forwarded-Prefix headers, enabling open redirects and request steering in Angular SSR applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44437?
CVE-2026-44437 is a medium-severity vulnerability in angular-cli, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%2e). This allows an attacker to bypass security filters by injecting encoded path traversal sequences that are later decoded and utilized by the application logic. When an Angular SSR application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Prefix header without prior sanitization, an attacker can provide a payload such as /%2e%2e/evil. This vulnerability is fixed in19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7.
Which versions are affected by CVE-2026-44437?
8 open source packages ship an affected version, including @angular/ssr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/ssr npm | From 19.0.0-next.0 | 19.2.25 |
@angular/ssr npm | From 19.0.0-next.0 | 19.2.25 |
@angular/ssr npm | From 20.0.0-next.0 | 20.3.25 |
@angular/ssr npm | From 20.0.0-next.0 | 20.3.25 |
@angular/ssr npm | From 21.0.0-next.0 | 21.2.9 |
@angular/ssr npm | From 21.0.0-next.0 | 21.2.9 |
2 more packages
@angular/ssr npm | From 22.0.0-next.0 | 22.0.0-next.7 |
@angular/ssr npm | From 22.0.0-next.0 | 22.0.0-next.7 |
Products include Angular Angular Cli.
How do I fix CVE-2026-44437?
Upgrade @angular/ssr to a fixed version for your release line: 19.2.25, 20.3.25, 21.2.9 or 22.0.0-next.7.
Is CVE-2026-44437 being exploited?
There is no known exploitation of CVE-2026-44437 in the wild and no public exploit code.
Other vulnerabilities in angular-cli
Sources
Also known as GHSA-69xr-m8h6-h664.