{"action":"Upgrade @angular/ssr to 20.3.21 or later.","affected":[{"fixed":"22.0.0-next.2","introduced":"22.0.0-next.0"},{"fixed":"21.2.3","introduced":"21.0.0-next.0"},{"fixed":"20.3.21","introduced":"20.0.0-next.0"}],"component":"@angular/ssr","cve_ids":["CVE-2026-33397"],"ecosystem":"npm","epss":0.0026,"exploited":false,"fixed_versions":["22.0.0-next.2","21.2.3","20.3.21"],"ghsa_id":"GHSA-vfx2-hv2g-xj5f","id":"tcs_01M5KGBSDKRNX66Y9XZ1TCTDHV","modified_at":"2026-05-06T20:48:57.282773Z","published_at":"2026-03-19T21:22:52Z","references":["https://osv.dev/vulnerability/GHSA-vfx2-hv2g-xj5f","https://github.com/angular/angular-cli/security/advisories/GHSA-vfx2-hv2g-xj5f","https://nvd.nist.gov/vuln/detail/CVE-2026-33397","https://github.com/angular/angular-cli/pull/32771","https://github.com/advisories/GHSA-xh43-g2fq-wjrj","https://github.com/angular/angular-cli"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-vfx2-hv2g-xj5f","url":"https://osv.dev/vulnerability/GHSA-vfx2-hv2g-xj5f"}],"summary":"Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR"}