CVE-2026-111754
1 advisory.
npm/@angular/platform-server CVE-2026-111754: medium
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
Action: Upgrade @angular/platform-server to 20.3.33 or later.
npm i @angular/platform-server@22.2.1npm i @angular/platform-server@21.2.25npm i @angular/platform-server@20.3.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.2.1 | - |
| 21.0.0 | 21.2.25 | - |
| 20.0.0 | 20.3.33 | - |
| 0 | - | 19.2.25 |
Fixed versions
| 22.2.1 | 21.2.25 | 20.3.33 |
Sources
- osv: GHSA-w739-gvwx-grc3
- https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3
- https://github.com/angular/angular/pull/71077
- https://github.com/angular/angular/pull/71078
- https://github.com/angular/angular/pull/71079
- https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a
- https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262
- https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521
- https://github.com/angular/angular/commit/d7d81e189d227108c3b9d39178dbb7389f6f970d
- https://github.com/angular/angular
- https://github.com/angular/angular/releases/tag/v20.3.33
- https://github.com/angular/angular/releases/tag/v21.2.25
- https://github.com/angular/angular/releases/tag/v22.2.1
CVE-2026-111754 · published · modified · JSON