Detections
Analytics

SCA: security update for @angular/ssr (GHSA-vfx2-hv2g-xj5f)

medium Tenable Self-Hosted Container Security Plugin ID 439040

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch
 prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open
 Redirect vulnerability in `@angular/ssr` due to an incomplete fix for CVE-2026-27738. While the original
 fix successfully blocked multiple leading slashes (e.g., `///`), the internal validation logic fails to
 account for a single backslash (`\`) bypass. When an Angular SSR application is deployed behind a proxy
 that passes the `X-Forwarded-Prefix` header, an attacker provides a value starting with a single
 backslash, the internal validation failed to flag the single backslash as invalid, the application
 prepends a leading forward slash, resulting in a `Location` header containing the URL, and modern browsers
 interpret the `/\` sequence as `//`, treating it as a protocol-relative URL and redirecting the user to
 the attacker-controlled domain. Furthermore, the response lacks the `Vary: X-Forwarded-Prefix` header,
 allowing the malicious redirect to be stored in intermediate caches (Web Cache Poisoning). Versions
 22.0.0-next.2, 21.2.3, and 20.3.21 contain a patch. Until the patch is applied, developers should sanitize
 the `X-Forwarded-Prefix` header in their `server.ts` before the Angular engine processes the request.
 (CVE-2026-33397)

Solution

Update the @angular/ssr library and its related packages to version 20.3.21 or later.

See Also

https://github.com/advisories/GHSA-vfx2-hv2g-xj5f

Plugin Details

Severity: Medium

ID: 439040

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 3/20/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-33397

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/19/2026

Vulnerability Publication Date: 3/19/2026

Reference Information

CVE: CVE-2026-33397

cwe: CWE-601