6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27738

CVE-2026-27738: Angular SSR has an Open Redirect via X-Forwarded-Prefix

The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the X-Forwarded-Prefix header, an attacker can provide a value starting with three slashes. This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking. In order to be vulnerable, the application must use Angular SSR, the application must have routes that perform internal redirects, the infrastructure (Reverse Proxy/CDN) must pass the X-Forwarded-Prefix header to the SSR process without sanitization, and the cache must not vary on the X-Forwarded-Prefix header. Versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 contain a patch. Until the patch is applied, developers should sanitize the X-Forwarded-Prefix header in theirserver.ts before the Angular engine processes the request.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27738

CVE-2026-27738:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/ssr	npm	>= 21.2.0-next.0, < 21.2.0-rc.0	21.2.0-rc.1
@angular/ssr	npm	>= 21.0.0-next.0, < 21.1.5	21.1.5
@angular/ssr	npm	>= 20.0.0-next.0, < 20.3.17	20.3.17
@angular/ssr	npm	>= 19.0.0-next.0, < 19.2.21	19.2.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in Angular SSR caused by improper handling of the X-Forwarded-Prefix header. The root cause lies in the joinUrlParts function located in packages/angular/ssr/src/utils/url.ts.

The analysis of the patch f086eccc36d10cf01c426e35864bc32e1e292323 reveals that the joinUrlParts function was modified. Before the patch, the function removed only a single leading slash from the URL parts it was joining. An attacker could provide an X-Forwarded-Prefix header with three or more leading slashes (e.g., ///evil.com). The vulnerable joinUrlParts function would process this, strip only one slash, and return //evil.com. When this string is used in a Location header for a redirect, browsers interpret it as a protocol-relative URL, redirecting the user to a malicious external domain.

The patch corrects this by changing the logic to a loop that strips all leading slashes, ensuring that any prefix is correctly joined to the path. Additionally, a defense-in-depth mitigation was added in the validateHeaders function to reject headers that start with multiple slashes.

Therefore, the function joinUrlParts is the vulnerable function, as it's the one that improperly processes the malicious input, leading to the open redirect. During exploitation on a vulnerable system, this function would be present in the runtime profile as it constructs the malicious redirect URL.

Vulnerable functions

joinUrlParts

packages/angular/ssr/src/utils/url.ts

The vulnerability lies in the `joinUrlParts` function, which was responsible for normalizing and joining URL segments. The original implementation only removed a single leading slash from each URL part. When an attacker supplied a specially crafted `X-Forwarded-Prefix` header (e.g., `///evil.com`), this function would incorrectly process it into a protocol-relative URL (`//evil.com`). This output would then be used in a redirect, causing the browser to redirect to an external, malicious site.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.