{"action":"Upgrade @angular/platform-server to 20.3.33 or later.","affected":[{"fixed":"22.2.1","introduced":"22.0.0"},{"fixed":"21.2.25","introduced":"21.0.0"},{"fixed":"20.3.33","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-111754"],"ecosystem":"npm","exploited":false,"fixed_versions":["22.2.1","21.2.25","20.3.33"],"ghsa_id":"GHSA-w739-gvwx-grc3","id":"tcs_01M5JK7XB9609QG4DM498Q8VM1","modified_at":"2026-10-20T14:45:03.771349618Z","published_at":"2026-10-20T14:35:49Z","references":["https://osv.dev/vulnerability/GHSA-w739-gvwx-grc3","https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3","https://github.com/angular/angular/pull/71077","https://github.com/angular/angular/pull/71078","https://github.com/angular/angular/pull/71079","https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a","https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262","https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521","https://github.com/angular/angular/commit/d7d81e189d227108c3b9d39178dbb7389f6f970d","https://github.com/angular/angular","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-w739-gvwx-grc3","url":"https://osv.dev/vulnerability/GHSA-w739-gvwx-grc3"}],"summary":"@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)"}