{"action":"Upgrade @angular/ssr to 19.2.25 or later.","affected":[{"fixed":"22.0.0-next.7","introduced":"22.0.0-next.0"},{"fixed":"21.2.9","introduced":"21.0.0-next.0"},{"fixed":"20.3.25","introduced":"20.0.0-next.0"},{"fixed":"19.2.25","introduced":"19.0.0-next.0"}],"component":"@angular/ssr","cve_ids":["CVE-2026-44437"],"ecosystem":"npm","epss":0.00203,"exploited":false,"fixed_versions":["22.0.0-next.7","21.2.9","20.3.25","19.2.25"],"ghsa_id":"GHSA-69xr-m8h6-h664","id":"tcs_01M5KF6JWRQ8K56XRYM5FSZ4YM","modified_at":"2026-05-14T20:50:01.464817Z","published_at":"2026-05-06T23:42:10Z","references":["https://osv.dev/vulnerability/GHSA-69xr-m8h6-h664","https://github.com/angular/angular-cli/security/advisories/GHSA-69xr-m8h6-h664","https://nvd.nist.gov/vuln/detail/CVE-2026-44437","https://github.com/angular/angular-cli/pull/33031","https://angular.dev/best-practices/security#configuring-trusted-proxy-headers","https://github.com/angular/angular-cli"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-69xr-m8h6-h664","url":"https://osv.dev/vulnerability/GHSA-69xr-m8h6-h664"},{"source":"nvd","source_id":"CVE-2026-44437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44437"}],"summary":"Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix"}