{"affected":[{"product":"angular","source":"CNA: GitHub_M","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.33"},{"status":"affected","version":">= 21.0.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/platform-server","product":"@angular/platform-server","source":"OSV GHSA-w739-gvwx-grc3","vendor":"","versions":[{"events":[{"introduced":"22.0.0"},{"fixed":"22.2.1"}],"lessThan":"22.2.1","status":"affected","version":"22.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/platform-server","product":"@angular/platform-server","source":"OSV GHSA-w739-gvwx-grc3","vendor":"","versions":[{"events":[{"introduced":"21.0.0"},{"fixed":"21.2.25"}],"lessThan":"21.2.25","status":"affected","version":"21.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/platform-server","product":"@angular/platform-server","source":"OSV GHSA-w739-gvwx-grc3","vendor":"","versions":[{"events":[{"introduced":"20.0.0"},{"fixed":"20.3.33"}],"lessThan":"20.3.33","status":"affected","version":"20.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/platform-server","product":"@angular/platform-server","source":"OSV GHSA-w739-gvwx-grc3","vendor":"","versions":[{"events":[{"introduced":"0"},{"last_affected":"19.2.25"}],"lessThanOrEqual":"19.2.25","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-111754","cwes":["CWE-601"],"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1793741035644,"publishedAt":1793739311497,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/issues/71076"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/pull/71077"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/pull/71078"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/pull/71079"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-w739-gvwx-grc3"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-w739-gvwx-grc3"}],"remediation":[{"kind":"fix","source":"OSV GHSA-w739-gvwx-grc3","text":"@angular/platform-server (npm): OSV reports a fixed version 22.2.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-w739-gvwx-grc3"},{"kind":"fix","source":"OSV GHSA-w739-gvwx-grc3","text":"@angular/platform-server (npm): OSV reports a fixed version 21.2.25. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-w739-gvwx-grc3"},{"kind":"fix","source":"OSV GHSA-w739-gvwx-grc3","text":"@angular/platform-server (npm): OSV reports a fixed version 20.3.33. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-w739-gvwx-grc3"}],"revision":"739ab1334c39617319ea9cd59582c573a1eae26092df6520ae5bdc7c70074c2e","sources":[{"modifiedAt":1793741035644,"name":"CNA: GitHub_M","retrievedAt":1793747316603,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111754"},{"modifiedAt":1792507503771,"name":"OSV / GitHub Security Advisories","retrievedAt":1793740119287,"url":"https://osv.dev/vulnerability/GHSA-w739-gvwx-grc3"}],"ssvc":{"assessedAt":1793741009234,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","updatedAt":1793747316603}