@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) (CVE-2026-111754)

The vulnerability in @angular/platform-server's SSR occurs because the URL resolution logic uses resolveUrl (or parseUrl in v20) which initially rejects protocol-relative URLs starting with '//' before WHATWG URL normalization. However, URLs containing dot-segments followed by multiple slashes (e.g., '/.//evil.test') bypass this initial check. After normalization, the pathname starts with '//evil.test', which is stored and later emitted in the Location header during a redirect. Browsers interpret this as a protocol-relative redirect to an external domain. This allows unauthenticated attackers to craft URLs that bypass application-level guards and cause SSR to redirect users off-origin. The vulnerability affects SSR-enabled Angular applications with parameterized routes and reverse proxies that do not normalize or strip semicolons or dot-segments. The issue is resolved by patching resolveUrl and parseUrl to verify the normalized pathname does not start with '//' when protocol-relative URLs are disallowed.

An unauthenticated remote attacker can exploit this vulnerability to cause Angular SSR to issue HTTP 302 redirects to arbitrary external domains. This bypasses common application-level redirect allowlists that do not account for URL normalization bypasses. The redirect can lead users to malicious sites, potentially facilitating phishing or other attacks. Pure client-side Angular applications without SSR are not vulnerable. No known exploits in the wild have been reported.

A fix is available in @angular/platform-server versions 22.2.1, 21.2.25, and 20.3.33. Applications should upgrade to these versions to remediate the vulnerability. If immediate upgrade is not possible, mitigations include configuring edge reverse proxies or WAFs to reject requests containing suspicious path normalization sequences such as '/.//', '/..//', or '/.;/'. Additionally, proxies or API gateways should sanitize or disallow protocol-relative ('//') Location headers in HTTP responses originating from the SSR backend.