Open Redirect Affecting @angular/platform-server package, versions <20.3.33>=21.0.0 <21.2.25>=22.0.0 <22.2.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ANGULARPLATFORMSERVER-21347776
- published21 Oct 2026
- disclosed20 Oct 2026
- creditJaime Burgos
Introduced: 20 Oct 2026
NewCVE-2026-111754 (opens in a new tab)How to fix?
Upgrade @angular/platform-server to version 20.3.33, 21.2.25, 22.2.1 or higher.
Overview
@angular/platform-server is an Angular - library for using Angular in Node.js
Affected versions of this package are vulnerable to Open Redirect via the resolveUrl function in packages/platform-server/src/url.ts, where WHATWG URL dot-segment normalization is applied after the raw-string protocol-relative check. An attacker can supply a path such as /.//evil.test, which passes the initial // prefix guard but is normalized by the WHATWG URL parser into a pathname beginning with //, producing a protocol-relative open redirect in SSR that corrupts ServerPlatformLocation.