tocsin

npm/@angular/ssr CVE-2026-27739: critical 9.2, EPSS 0.55%

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Action: Upgrade @angular/ssr to 19.2.21 or later.

npm i @angular/ssr@21.2.0-rc.1
npm i @angular/ssr@21.1.5
npm i @angular/ssr@20.3.17
npm i @angular/ssr@19.2.21

Affected

introducedfixedlast affected
21.2.0-next.021.2.0-rc.1-
21.0.0-next.021.1.5-
20.0.0-next.020.3.17-
019.2.21-

Fixed versions

21.2.0-rc.121.1.520.3.1719.2.21

Sources

CVE-2026-27739 · published · modified · JSON