- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 1 critical, 2 high, 4 medium
- Weekly downloads
- 716.6K
- Dependents
- 8
- Registry
- npm
Advisories 7
- CVE-2026-104871Medium 6.3
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Affected: from 22.0.0, fixed in 22.1.7; from 21.0.0, fixed in 21.2.23; from 20.0.0, fixed in 20.3.36; through 19.2.27.
- CVE-2026-44437Medium 6.9
Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Affected: from 22.0.0-next.0, fixed in 22.0.0-next.7; from 21.0.0-next.0, fixed in 21.2.9; from 20.0.0-next.0, fixed in 20.3.25; from 19.0.0-next.0, fixed in 19.2.25.
- CVE-2026-33397Medium 6.9
Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
Affected: from 22.0.0-next.0, fixed in 22.0.0-next.2; from 21.0.0-next.0, fixed in 21.2.3; from 20.0.0-next.0, fixed in 20.3.21.
- CVE-2026-27739Critical 9.2
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Affected: from 21.2.0-next.0, fixed in 21.2.0-rc.1; from 21.0.0-next.0, fixed in 21.1.5; from 20.0.0-next.0, fixed in 20.3.17; fixed in 19.2.21.
- CVE-2026-27738Medium 6.9
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Affected: from 21.2.0-next.0, fixed in 21.2.0-rc.1; from 21.0.0-next.0, fixed in 21.1.5; from 20.0.0-next.0, fixed in 20.3.17; from 19.0.0-next.0, fixed in 19.2.21.
- CVE-2025-62427High 8.7
Server-Side Request Forgery (SSRF) in Angular SSR
Affected: from 19.0.0-next.0, fixed in 19.2.18; from 20.0.0-next.0, fixed in 20.3.6; from 21.0.0-next.0, fixed in 21.0.0-next.8.
- CVE-2025-59052High 7.1
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Affected: from 17.0.0-next.0, fixed in 18.2.21; from 19.0.0-next.0, fixed in 19.2.16; from 20.0.0-next.0, fixed in 20.3.0; from 21.0.0-next.0, fixed in 21.0.0-next.3.