{"id":"GHSA-vfx2-hv2g-xj5f","summary":"Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR","details":"An Open Redirect vulnerability exists in `@angular/ssr` due to an incomplete fix for CVE-2026-27738. While the original fix successfully blocked multiple leading slashes (e.g., `///`), the internal validation logic fails to account for a single backslash (`\\`) bypass.\n\nWhen an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header:\n\n- An attacker provides a value starting with a single backslash (e.g., `\\evil.com`).\n- The internal validation failed to flag the single backslash as invalid.\n- The application prepends a leading forward slash, resulting in a `Location` header containing `/\\evil.com`.\n- Modern browsers interpret the `/\\` sequence as `//`, treating it as a protocol-relative URL and redirecting the user to the attacker-controlled domain.\n\nFurthermore, the response lacks the `Vary: X-Forwarded-Prefix` header, allowing the malicious redirect to be stored in intermediate caches (Web Cache Poisoning).\n\n### Impact\nThis vulnerability allows attackers to conduct large-scale phishing and SEO hijacking:\n\n- **Scale**: A single request can poison a high-traffic route, impacting all users until the cache expires.\n- **SEO Poisoning**: Search engine crawlers may follow and index these malicious redirects, causing the legitimate site to be delisted or associated with malicious domains.\n- **Trust**: Because the initial URL belongs to the trusted domain, users and security tools are less likely to flag the redirect as malicious.\n\n### Patches\n\n- 22.0.0-next.2\n- 21.2.3\n- 20.3.21\n\n### Workarounds\nUntil the patch is applied, developers should sanitize the `X-Forwarded-Prefix` header in their `server.ts` before the Angular engine processes the request:\n\n```ts\napp.use((req, res, next) =\u003e {\n  const prefix = req.headers['x-forwarded-prefix'];\n  if (typeof prefix === 'string') {\n    // Sanitize by removing all leading forward and backward slashes\n    req.headers['x-forwarded-prefix'] = prefix.trim().replace(/^[/\\\\]+/, '/');\n  }\n  next();\n});\n```\n\n\n### References\n\n- Fix: https://github.com/angular/angular-cli/pull/32771\n- Original CVE: CVE-2026-27738","aliases":["CVE-2026-33397"],"modified":"2026-05-06T20:48:57.282773Z","published":"2026-03-19T21:22:52Z","related":["CVE-2026-33397"],"database_specific":{"github_reviewed_at":"2026-03-19T21:22:52Z","nvd_published_at":"2026-03-26T15:16:38Z","cwe_ids":["CWE-601"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33397"},{"type":"WEB","url":"https://github.com/angular/angular-cli/pull/32771"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xh43-g2fq-wjrj"},{"type":"PACKAGE","url":"https://github.com/angular/angular-cli"}],"affected":[{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"22.0.0-next.0"},{"fixed":"22.0.0-next.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vfx2-hv2g-xj5f/GHSA-vfx2-hv2g-xj5f.json"}},{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"21.0.0-next.0"},{"fixed":"21.2.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vfx2-hv2g-xj5f/GHSA-vfx2-hv2g-xj5f.json"}},{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0-next.0"},{"fixed":"20.3.21"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vfx2-hv2g-xj5f/GHSA-vfx2-hv2g-xj5f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}