CVE-2026-27738

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27738
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27738.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27738
Aliases
Published
2026-02-25T16:40:44.724Z
Modified
2026-03-03T02:56:52.733672Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Details

The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the X-Forwarded-Prefix header, an attacker can provide a value starting with three slashes. This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking. In order to be vulnerable, the application must use Angular SSR, the application must have routes that perform internal redirects, the infrastructure (Reverse Proxy/CDN) must pass the X-Forwarded-Prefix header to the SSR process without sanitization, and the cache must not vary on the X-Forwarded-Prefix header. Versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 contain a patch. Until the patch is applied, developers should sanitize the X-Forwarded-Prefix header in theirserver.ts before the Angular engine processes the request.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27738.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ]
}
References

Affected packages

Git / github.com/angular/angular-cli

Affected ranges

Type
GIT
Repo
https://github.com/angular/angular-cli
Events
Introduced
311e335d1338bc921a43eb91b8587fb014985d76
Fixed
99ded1d45b1cf30cf107a69addf95611342a23e4
Database specific 
{
    "versions": [
        {
            "introduced": "21.2.0-next.2"
        },
        {
            "fixed": "21.2.0-rc.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/angular/angular-cli
Events
Introduced
2c99210e47b22342fea48e86bc61e8ba27fafb63
Fixed
0ad7cc38e13229ab3d081180dbe3a15ff9c9024f
Database specific 
{
    "versions": [
        {
            "introduced": "21.0.0-next.0"
        },
        {
            "fixed": "21.1.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/angular/angular-cli
Events
Introduced
896d98a31326d88acc3b8ddb80f9de34a71bf3a0
Fixed
c0d1626e87b807845d898e30f52e2251aa81c2a0
Database specific 
{
    "versions": [
        {
            "introduced": "20.0.0-next.0"
        },
        {
            "fixed": "20.3.17"
        }
    ]
}
Type
GIT
Repo
https://github.com/angular/angular-cli
Events
Introduced
a7f466a5fa87c51b914441524bd0dff5b3957ced
Fixed
4d9442a236bb37b95b8a8602389f87716407149c
Database specific 
{
    "versions": [
        {
            "introduced": "19.0.0-next.0"
        },
        {
            "fixed": "19.2.21"
        }
    ]
}

Affected versions

19.*
19.0.0-next.0
19.0.0-next.1
19.0.0-next.10
19.0.0-next.11
19.0.0-next.12
19.0.0-next.2
19.0.0-next.3
19.0.0-next.4
19.0.0-next.5
19.0.0-next.6
19.0.0-next.7
19.0.0-next.8
19.0.0-next.9
19.1.0-next.0
19.1.0-next.1
19.1.0-next.2
19.2.0
19.2.0-next.0
19.2.0-next.1
19.2.0-next.2
19.2.0-rc.0
19.2.1
19.2.10
19.2.11
19.2.12
19.2.13
19.2.14
19.2.15
19.2.16
19.2.17
19.2.18
19.2.19
19.2.2
19.2.3
19.2.4
19.2.5
19.2.6
19.2.7
19.2.8
19.2.9
20.*
20.0.0-next.0
20.0.0-next.1
20.0.0-next.2
20.0.0-next.3
20.0.0-next.4
20.0.0-next.5
20.0.0-next.6
20.0.0-next.7
20.0.0-next.8
20.1.0-next.0
20.1.0-next.1
20.1.0-next.2
20.1.0-next.3
20.2.0
20.2.0-next.0
20.2.0-next.1
20.2.0-next.2
20.2.0-next.3
20.2.0-rc.0
20.2.0-rc.1
20.2.1
20.2.2
20.3.0
20.3.0-rc.0
20.3.1
20.3.10
20.3.11
20.3.12
20.3.13
20.3.2
20.3.3
20.3.4
20.3.5
20.3.6
20.3.7
20.3.8
20.3.9
21.*
21.0.0-next.0
21.0.0-next.1
21.0.0-next.2
21.0.0-next.3
21.0.0-next.4
21.0.0-next.5
21.0.0-next.6
21.0.0-next.7
21.0.0-next.8
21.1.0-next.0
21.1.0-next.1
v19.*
v19.2.20
v20.*
v20.3.14
v20.3.15
v20.3.16
v21.*
v21.1.0
v21.1.0-next.2
v21.1.0-next.3
v21.1.0-rc.0
v21.1.1
v21.1.2
v21.1.3
v21.1.4
v21.2.0-next.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27738.json"