CVE-2026-104871

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

1. A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
2. The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
3. The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
4. The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
5. If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.

Attack Preconditions

• The application must use CommonEngine from @angular/ssr/node (or @angular/ssr in v17–v18).
• The application must be hosted on Windows (where Node's path.join resolves \ as a path separator).
• The application passes a relative request URL (such as req.url or req.originalUrl without origin) into CommonEngine.render({ url }).
• A sibling directory exists whose name starts with the same prefix as the configured publicPath directory (e.g., dist\app-admin alongside dist\app).
• The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.

Affected Versions

• >= 22.0.0, < 22.1.7
• >= 21.0.0, < 21.2.23
• >= 20.0.0, < 20.3.36
• <= 19.2.27

Workarounds

Until a patch is applied, developers using CommonEngine on Windows can sanitize request URLs in server.ts before passing them to CommonEngine.render, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:

server.use((req, res, next) => {
  const { protocol, originalUrl, headers } = req;

  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)
  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\/g, '/')}`;

  commonEngine
    .render({
      bootstrap,
      documentFilePath: indexHtml,
      url: sanitizedUrl,
      publicPath: distFolder,
    })
    .then((html) => res.send(html))
    .catch((err) => next(err));
});

Alternatively, migrate from the deprecated CommonEngine to AngularNodeAppEngine, which relies on manifest-based route matching rather than direct filesystem path resolution.