Angular SSR versions prior to 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 improperly validate the X-Forwarded-Prefix header by failing to decode and sanitize URL-encoded path traversal sequences such as %2e%2e. This allows attackers to inject encoded path traversal strings that bypass security filters, potentially leading to unauthorized directory access. The vulnerability affects Angular CLI versions within specified ranges and is resolved in the fixed versions mentioned.

An attacker can exploit this vulnerability to bypass security filters by injecting encoded path traversal sequences in the X-Forwarded-Prefix header. This may allow unauthorized access to restricted directories or resources within an Angular SSR application configured to trust proxy headers and deployed behind an unsanitizing proxy. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with no required privileges or user interaction but limited integrity and security scope impact.

A fix is available in Angular CLI versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Since no vendor advisory content is provided to indicate otherwise, patching to the fixed versions is the recommended mitigation. Additionally, ensure that proxies forwarding the X-Forwarded-Prefix header sanitize or validate this header to prevent injection of encoded path traversal sequences.