CVE-2026-104871
1 advisory.
npm/@angular/ssr CVE-2026-104871: medium, EPSS 0.42%
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Action: Upgrade @angular/ssr to 20.3.36 or later.
npm i @angular/ssr@22.1.7npm i @angular/ssr@21.2.23npm i @angular/ssr@20.3.36Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.1.7 | - |
| 21.0.0 | 21.2.23 | - |
| 20.0.0 | 20.3.36 | - |
| 0 | - | 19.2.27 |
Fixed versions
| 22.1.7 | 21.2.23 | 20.3.36 |
Sources
- osv: GHSA-7g7c-h8rr-7p6q
- https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-104871
- https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2
- https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755
- https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841
- https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914
- https://github.com/angular/angular-cli
- https://github.com/angular/angular-cli/releases/tag/v20.3.36
- https://github.com/angular/angular-cli/releases/tag/v21.2.23
- https://github.com/angular/angular-cli/releases/tag/v22.1.7
CVE-2026-104871 · published · modified · JSON