CVE-2026-27738

An Open Redirect vulnerability exists in the internal URL processing logic in Angular SSR. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash.

When an Angular SSR application is deployed behind a proxy that passes the X-Forwarded-Prefix header, an attacker can provide a value starting with three slashes (e.g., ///evil.com).

1. The application processes a redirect (e.g., from a router redirectTo or i18n locale switch).
2. Angular receives ///evil.com as the prefix.
3. It strips one slash, leaving //evil.com.
4. The resulting string is used in the Location header.
5. Modern browsers interpret // as a protocol-relative URL, redirecting the user from https://your-app.com to https://evil.com.

Attack Preconditions

• The application must use Angular SSR.
• The application must have routes that perform internal redirects.
• The infrastructure (Reverse Proxy/CDN) must pass the X-Forwarded-Prefix header to the SSR process without sanitization.
• The cache must not vary on the X-Forwarded-Prefix header.

Workarounds

Until the patch is applied, developers should sanitize the X-Forwarded-Prefix header in theirserver.ts before the Angular engine processes the request:

app.use((req, res, next) => {
  const prefix = req.headers['x-forwarded-prefix']?.trim();
  if (prefix) {
    // Sanitize by removing all leading slashes
    req.headers['x-forwarded-prefix'] = prefix.replace(/^[/\\]+/, '/');
  }
  next();
});

Resources

• Report
• Fix

This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking:

• Scale: A single request can poison a high-traffic route, impacting all users until the cache expires.
• SEO Poisoning: Search engine crawlers may follow and index these malicious redirects, causing the legitimate site to be delisted or associated with malicious domains.
• Trust: Because the initial URL belongs to the trusted domain, users and security tools are less likely to flag the redirect as malicious.

Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites. Typical impact: phishing and credential harvesting via a trusted domain.

Kodem intelligence

• 21.2.0-rc.1
• 21.1.5
• 20.3.17
• 19.2.21

1. What is CVE-2026-27738? CVE-2026-27738 is a medium-severity open redirect vulnerability in @angular/ssr (npm), affecting versions >= 21.2.0-next.0, < 21.2.0-rc.0. It is fixed in 21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21. Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites.
2. Which versions of @angular/ssr are affected by CVE-2026-27738? @angular/ssr (npm) versions >= 21.2.0-next.0, < 21.2.0-rc.0 is affected.
3. Is there a fix for CVE-2026-27738? Yes. CVE-2026-27738 is fixed in 21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21. Upgrade to this version or later.
4. Is CVE-2026-27738 exploitable, and should I be worried? Whether CVE-2026-27738 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-27738 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-27738?
   • Upgrade @angular/ssr to 21.2.0-rc.1 or later
   • Upgrade @angular/ssr to 21.1.5 or later
   • Upgrade @angular/ssr to 20.3.17 or later
   • Upgrade @angular/ssr to 19.2.21 or later