{"id":"CVE-2026-104871","aliases":["CLSA-2026-1791302781","CLSA-2026-1791320260","CLSA-2026-1791320540","CLSA-2026-1791320698","CLSA-2026-1791322653","CLSA-2026-1792163463","CLSA-2026-1792163464","CLSA-2026-1792163465","CLSA-2026-1792163466","CLSA-2026-1792163467","CLSA-2026-1792202609","CLSA-2026-1792202610","CLSA-2026-1792202611","CLSA-2026-1792202612","CLSA-2026-1792248409","CLSA-2026-1792248410","CLSA-2026-1792248411","CLSA-2026-1792248412","CLSA-2026-1792279536","CLSA-2026-1792279537","CLSA-2026-1792279538","CLSA-2026-1792279539","CLSA-2026-1792279540","CLSA-2026-1792327355","CLSA-2026-1792327356","CLSA-2026-1792327357","CLSA-2026-1792327358","CLSA-2026-1792339037","CLSA-2026-1792339038","CLSA-2026-1792339039","CLSA-2026-1792339040","CLSA-2026-1792339041","CLSA-2026-1792348155","CLSA-2026-1792348156","CLSA-2026-1792348157","CLSA-2026-1792348158","CLSA-2026-1792348159","CLSA-2026-1792358885","CLSA-2026-1792358886","CLSA-2026-1792358887","CLSA-2026-1792358888","CLSA-2026-1792364766","CLSA-2026-1792364767","CLSA-2026-1792364768","CLSA-2026-1792364769","CLSA-2026-1792364771","EUVD-2026-91778","GHSA-7g7c-h8rr-7p6q"],"status":"published","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00421,"percentile":0.36906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-10-02T19:43:50Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"npm","package":"@angular/ssr","fixed_in":["22.1.7","21.2.23","20.3.36"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/cli","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/pwa","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/build","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular-devkit/build-angular","fixed_in":["22.1.6-tuxcare.1","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular-devkit/core","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics-cli","fixed_in":["22.1.6-tuxcare.1","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/create","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@angular/ssr","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","17.3.17-tuxcare.5","18.2.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@ngtools/webpack","fixed_in":["22.1.6-tuxcare.1","19.2.27-tuxcare.2","18.2.21-tuxcare.3","17.3.17-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@schematics/angular","fixed_in":["22.1.6-tuxcare.1","19.2.25-tuxcare.3","19.2.27-tuxcare.2","18.2.21-tuxcare.3","17.3.17-tuxcare.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.1.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.2.23"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.3.36"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.2.27"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.1","17.3.17-tuxcare.2","17.3.17-tuxcare.3","17.3.17-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.1","17.3.17-tuxcare.2","17.3.17-tuxcare.3","17.3.17-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.1","17.3.17-tuxcare.2","17.3.17-tuxcare.3","17.3.17-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/build-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/build-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/build-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/build-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular-devkit/schematics-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/create","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/create","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/create","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/create","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.1","17.3.17-tuxcare.2","17.3.17-tuxcare.3","17.3.17-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/create","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.1","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.1","17.3.17-tuxcare.2","17.3.17-tuxcare.3","17.3.17-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@angular/ssr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.1","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@ngtools/webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@ngtools/webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@ngtools/webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@ngtools/webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@schematics/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.6-tuxcare.0"},{"fixed":"22.1.6-tuxcare.1"}]}],"versions":["22.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@schematics/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.25-tuxcare.0"},{"fixed":"19.2.25-tuxcare.3"}]}],"versions":["19.2.25","19.2.25-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@schematics/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.27-tuxcare.0"},{"fixed":"19.2.27-tuxcare.2"}]}],"versions":["19.2.27","19.2.27-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@schematics/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.2.21-tuxcare.0"},{"fixed":"18.2.21-tuxcare.3"}]}],"versions":["18.2.21","18.2.21-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@schematics/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.17-tuxcare.0"},{"fixed":"17.3.17-tuxcare.5"}]}],"versions":["17.3.17","17.3.17-tuxcare.3"]},{"source":"osv","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"introduced":"22.0.0"},{"fixed":"22.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"introduced":"21.0.0"},{"fixed":"21.2.23"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.3.36"}]}]},{"source":"osv","ecosystem":"npm","package":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"19.2.27"}]}]}],"products":[{"vendor":"angular","product":"angular-cli"}],"references":[{"url":"https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/angular/angular-cli/releases/tag/v20.3.36","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/angular/angular-cli/releases/tag/v21.2.23","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/angular/angular-cli/releases/tag/v22.1.7","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104871","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7g7c-h8rr-7p6q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104871.json","tags":["advisory"]},{"url":"https://github.com/angular/angular-cli","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-104871","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","status":"published","published":"2026-10-02T19:43:50.475Z","modified":"2026-10-02T20:12:49.364Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-91778","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","status":"published","published":"2026-10-02T19:43:50Z","modified":"2026-10-02T20:12:49Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:41.962371Z"}],"ghsa":[{"id":"GHSA-7g7c-h8rr-7p6q","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","description":"A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of `CommonEngine` in `@angular/ssr/node` (and `@angular/ssr` in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes `CommonEngine` to serve prerendered pages from sibling output directories.\n\nThe vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:\n\n1. A request URL containing a backslash parent traversal segment (e.g., `/..\\app-admin`) is passed to `CommonEngine.render({ url })`.\n2. The engine parses the URL using `new URL(url, 'resolve://')`. Because `resolve://` is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the `pathname` unnormalized as `/..\\app-admin`.\n3. The engine constructs the candidate file path using `join(publicPath, pathname, 'index.html')`. On Windows, `path.join` treats `\\` as a path delimiter, resolving the parent segment (`..\\`) out of `publicPath` (e.g., `dist\\app`) into a sibling directory (e.g., `dist\\app-admin\\index.html`).\n4. The containment check (`pagePath.startsWith(normalize(publicPath))`) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., `dist\\app-admin` starts with `dist\\app`), the check erroneously succeeds.\n5. If the target file exists and contains the Angular SSG marker (`ng-server-context=\"...ssg...\"`), `CommonEngine` reads and serves the sibling page instead of rendering the requested route.\n\n### Impact\n\nThis vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:\n\n- **Information Disclosure:** Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app `app-admin` adjacent to `app`) can be accessed by unauthorized users.\n- **Limited Scope:** Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.\n\n### Attack Preconditions\n\n- The application must use `CommonEngine` from `@angular/ssr/node` (or `@angular/ssr` in v17–v18).\n- The application must be hosted on Windows (where Node's `path.join` resolves `\\` as a path separator).\n- The application passes a relative request URL (such as `req.url` or `req.originalUrl` without origin) into `CommonEngine.render({ url })`.\n- A sibling directory exists whose name starts with the same prefix as the configured `publicPath` directory (e.g., `dist\\app-admin` alongside `dist\\app`).\n- The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.\n\n### Affected Versions\n\n- `\u003e= 22.0.0, \u003c 22.1.7`\n- `\u003e= 21.0.0, \u003c 21.2.23`\n- `\u003e= 20.0.0, \u003c 20.3.36`\n- `\u003c= 19.2.27`\n\n### Patches\n\n- `22.1.7`\n- `21.2.23`\n- `20.3.36`\n\n\u003e Versions `\u003c= 19.2.27` have reached End of Support / LTS expiration and will not be patched.\n\n### Workarounds\n\nUntil a patch is applied, developers using `CommonEngine` on Windows can sanitize request URLs in `server.ts` before passing them to `CommonEngine.render`, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:\n\n```ts\nserver.use((req, res, next) =\u003e {\n  const { protocol, originalUrl, headers } = req;\n\n  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)\n  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\\\/g, '/')}`;\n\n  commonEngine\n    .render({\n      bootstrap,\n      documentFilePath: indexHtml,\n      url: sanitizedUrl,\n      publicPath: distFolder,\n    })\n    .then((html) =\u003e res.send(html))\n    .catch((err) =\u003e next(err));\n});\n```\n\nAlternatively, migrate from the deprecated `CommonEngine` to `AngularNodeAppEngine`, which relies on manifest-based route matching rather than direct filesystem path resolution.","status":"published","published":"2026-10-05T22:53:45Z","modified":"2026-10-05T22:53:46Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-104871","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","status":"published","published":"2026-10-02T20:17:00.91Z","modified":"2026-10-06T16:00:36.547Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-104871","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","status":"published","published":"2026-10-02T19:43:50.475Z","modified":"2026-10-28T02:31:03.600170086Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"GHSA-7g7c-h8rr-7p6q","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","description":"A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of `CommonEngine` in `@angular/ssr/node` (and `@angular/ssr` in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes `CommonEngine` to serve prerendered pages from sibling output directories.\n\nThe vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:\n\n1. A request URL containing a backslash parent traversal segment (e.g., `/..\\app-admin`) is passed to `CommonEngine.render({ url })`.\n2. The engine parses the URL using `new URL(url, 'resolve://')`. Because `resolve://` is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the `pathname` unnormalized as `/..\\app-admin`.\n3. The engine constructs the candidate file path using `join(publicPath, pathname, 'index.html')`. On Windows, `path.join` treats `\\` as a path delimiter, resolving the parent segment (`..\\`) out of `publicPath` (e.g., `dist\\app`) into a sibling directory (e.g., `dist\\app-admin\\index.html`).\n4. The containment check (`pagePath.startsWith(normalize(publicPath))`) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., `dist\\app-admin` starts with `dist\\app`), the check erroneously succeeds.\n5. If the target file exists and contains the Angular SSG marker (`ng-server-context=\"...ssg...\"`), `CommonEngine` reads and serves the sibling page instead of rendering the requested route.\n\n### Impact\n\nThis vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:\n\n- **Information Disclosure:** Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app `app-admin` adjacent to `app`) can be accessed by unauthorized users.\n- **Limited Scope:** Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.\n\n### Attack Preconditions\n\n- The application must use `CommonEngine` from `@angular/ssr/node` (or `@angular/ssr` in v17–v18).\n- The application must be hosted on Windows (where Node's `path.join` resolves `\\` as a path separator).\n- The application passes a relative request URL (such as `req.url` or `req.originalUrl` without origin) into `CommonEngine.render({ url })`.\n- A sibling directory exists whose name starts with the same prefix as the configured `publicPath` directory (e.g., `dist\\app-admin` alongside `dist\\app`).\n- The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.\n\n### Affected Versions\n\n- `\u003e= 22.0.0, \u003c 22.1.7`\n- `\u003e= 21.0.0, \u003c 21.2.23`\n- `\u003e= 20.0.0, \u003c 20.3.36`\n- `\u003c= 19.2.27`\n\n### Patches\n\n- `22.1.7`\n- `21.2.23`\n- `20.3.36`\n\n\u003e Versions `\u003c= 19.2.27` have reached End of Support / LTS expiration and will not be patched.\n\n### Workarounds\n\nUntil a patch is applied, developers using `CommonEngine` on Windows can sanitize request URLs in `server.ts` before passing them to `CommonEngine.render`, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:\n\n```ts\nserver.use((req, res, next) =\u003e {\n  const { protocol, originalUrl, headers } = req;\n\n  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)\n  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\\\/g, '/')}`;\n\n  commonEngine\n    .render({\n      bootstrap,\n      documentFilePath: indexHtml,\n      url: sanitizedUrl,\n      publicPath: distFolder,\n    })\n    .then((html) =\u003e res.send(html))\n    .catch((err) =\u003e next(err));\n});\n```\n\nAlternatively, migrate from the deprecated `CommonEngine` to `AngularNodeAppEngine`, which relies on manifest-based route matching rather than direct filesystem path resolution.","status":"published","published":"2026-10-05T22:53:45Z","modified":"2026-10-05T23:00:04.245230888Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"CLSA-2026-1791302781","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-06T16:06:21Z","modified":"2026-10-19T07:45:44.395064252Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791320260","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-06T20:57:40Z","modified":"2026-10-19T07:45:43.762946011Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791320540","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-06T21:02:20Z","modified":"2026-10-19T07:45:44.370080402Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791320698","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-06T21:04:58Z","modified":"2026-10-19T07:45:44.287735158Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791322653","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-06T21:37:33Z","modified":"2026-10-19T07:45:43.786909762Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792163463","title":"TuxCare security update for @angular/pwa (1 CVE)","description":"TuxCare rebuilt @angular/pwa to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-16T15:11:01Z","modified":"2026-10-16T16:30:59.348096035Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792163464","title":"TuxCare security update for @angular/pwa (1 CVE)","description":"TuxCare rebuilt @angular/pwa to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-16T15:11:02Z","modified":"2026-10-16T16:30:59.351633304Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792163465","title":"TuxCare security update for @angular/pwa (1 CVE)","description":"TuxCare rebuilt @angular/pwa to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-16T15:11:03Z","modified":"2026-10-16T16:30:59.353846297Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792163466","title":"TuxCare security update for @angular/pwa (1 CVE)","description":"TuxCare rebuilt @angular/pwa to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-16T15:11:04Z","modified":"2026-10-16T16:30:59.345822012Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792163467","title":"TuxCare security update for @angular/pwa (1 CVE)","description":"TuxCare rebuilt @angular/pwa to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-16T15:11:06Z","modified":"2026-10-16T16:31:45.291086657Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792202609","title":"TuxCare security update for @angular/build (1 CVE)","description":"TuxCare rebuilt @angular/build to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-17T02:03:29Z","modified":"2026-10-17T07:00:34.673791265Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792202610","title":"TuxCare security update for @angular/build (1 CVE)","description":"TuxCare rebuilt @angular/build to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-17T02:03:30Z","modified":"2026-10-17T07:00:35.122326972Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792202611","title":"TuxCare security update for @angular/build (1 CVE)","description":"TuxCare rebuilt @angular/build to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-17T02:03:31Z","modified":"2026-10-17T07:00:34.67124088Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792202612","title":"TuxCare security update for @angular/build (1 CVE)","description":"TuxCare rebuilt @angular/build to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-17T02:03:32Z","modified":"2026-10-17T07:00:34.71300442Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792248409","title":"TuxCare security update for @angular-devkit/build-angular (1 CVE)","description":"TuxCare rebuilt @angular-devkit/build-angular to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-17T14:46:47Z","modified":"2026-10-17T19:01:21.920845202Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792248410","title":"TuxCare security update for @angular-devkit/build-angular (1 CVE)","description":"TuxCare rebuilt @angular-devkit/build-angular to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-17T14:46:48Z","modified":"2026-10-17T19:01:22.275609162Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792248411","title":"TuxCare security update for @angular-devkit/build-angular (1 CVE)","description":"TuxCare rebuilt @angular-devkit/build-angular to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-17T14:46:49Z","modified":"2026-10-17T19:01:10.901425791Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792248412","title":"TuxCare security update for @angular-devkit/build-angular (1 CVE)","description":"TuxCare rebuilt @angular-devkit/build-angular to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-17T14:46:49Z","modified":"2026-10-17T19:01:22.223980077Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792279536","title":"TuxCare security update for @angular-devkit/core (1 CVE)","description":"TuxCare rebuilt @angular-devkit/core to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-17T23:25:36Z","modified":"2026-10-18T01:30:41.609682267Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792279537","title":"TuxCare security update for @angular-devkit/core (1 CVE)","description":"TuxCare rebuilt @angular-devkit/core to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-17T23:25:37Z","modified":"2026-10-18T01:30:44.80494436Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792279538","title":"TuxCare security update for @angular-devkit/core (1 CVE)","description":"TuxCare rebuilt @angular-devkit/core to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-17T23:25:38Z","modified":"2026-10-18T01:30:42.609420123Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792279539","title":"TuxCare security update for @angular-devkit/core (1 CVE)","description":"TuxCare rebuilt @angular-devkit/core to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-17T23:25:38Z","modified":"2026-10-18T01:30:48.925301278Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792279540","title":"TuxCare security update for @angular-devkit/core (1 CVE)","description":"TuxCare rebuilt @angular-devkit/core to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-17T23:25:38Z","modified":"2026-10-18T01:30:42.603231061Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792327355","title":"TuxCare security update for @angular-devkit/schematics-cli (1 CVE)","description":"TuxCare rebuilt @angular-devkit/schematics-cli to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-18T12:42:33Z","modified":"2026-10-18T19:15:39.39677303Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792327356","title":"TuxCare security update for @angular-devkit/schematics-cli (1 CVE)","description":"TuxCare rebuilt @angular-devkit/schematics-cli to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-18T12:42:35Z","modified":"2026-10-18T19:15:39.392985848Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792327357","title":"TuxCare security update for @angular-devkit/schematics-cli (1 CVE)","description":"TuxCare rebuilt @angular-devkit/schematics-cli to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-18T12:42:35Z","modified":"2026-10-18T19:15:39.40294986Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792327358","title":"TuxCare security update for @angular-devkit/schematics-cli (1 CVE)","description":"TuxCare rebuilt @angular-devkit/schematics-cli to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-18T12:42:36Z","modified":"2026-10-18T19:15:39.398962338Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792339037","title":"TuxCare security update for @angular/create (1 CVE)","description":"TuxCare rebuilt @angular/create to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-18T15:57:17Z","modified":"2026-10-18T19:15:42.915248669Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792339038","title":"TuxCare security update for @angular/create (1 CVE)","description":"TuxCare rebuilt @angular/create to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-18T15:57:18Z","modified":"2026-10-18T19:15:44.118222192Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792339039","title":"TuxCare security update for @angular/create (1 CVE)","description":"TuxCare rebuilt @angular/create to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-18T15:57:19Z","modified":"2026-10-18T19:15:43.658933306Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792339040","title":"TuxCare security update for @angular/create (1 CVE)","description":"TuxCare rebuilt @angular/create to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-18T15:57:20Z","modified":"2026-10-18T19:15:42.922368709Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792339041","title":"TuxCare security update for @angular/create (1 CVE)","description":"TuxCare rebuilt @angular/create to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-18T15:57:21Z","modified":"2026-10-18T19:15:43.661515594Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792348155","title":"TuxCare security update for @angular/ssr (1 CVE)","description":"TuxCare rebuilt @angular/ssr to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-18T18:29:15Z","modified":"2026-10-18T19:16:08.310332799Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792348156","title":"TuxCare security update for @angular/ssr (1 CVE)","description":"TuxCare rebuilt @angular/ssr to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-18T18:29:16Z","modified":"2026-10-18T19:16:05.457418144Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792348157","title":"TuxCare security update for @angular/ssr (1 CVE)","description":"TuxCare rebuilt @angular/ssr to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-18T18:29:17Z","modified":"2026-10-18T19:16:08.327994212Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792348158","title":"TuxCare security update for @angular/ssr (1 CVE)","description":"TuxCare rebuilt @angular/ssr to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-18T18:29:17Z","modified":"2026-10-18T19:16:08.319692136Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792348159","title":"TuxCare security update for @angular/ssr (1 CVE)","description":"TuxCare rebuilt @angular/ssr to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-18T18:29:18Z","modified":"2026-10-18T19:16:08.652507129Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358885","title":"TuxCare security update for @ngtools/webpack (1 CVE)","description":"TuxCare rebuilt @ngtools/webpack to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-18T21:28:05Z","modified":"2026-10-19T07:46:01.582374202Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792358886","title":"TuxCare security update for @ngtools/webpack (1 CVE)","description":"TuxCare rebuilt @ngtools/webpack to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-18T21:28:05Z","modified":"2026-10-19T07:45:57.369852211Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792358887","title":"TuxCare security update for @ngtools/webpack (1 CVE)","description":"TuxCare rebuilt @ngtools/webpack to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-18T21:28:06Z","modified":"2026-10-19T07:46:02.235185735Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792358888","title":"TuxCare security update for @ngtools/webpack (1 CVE)","description":"TuxCare rebuilt @ngtools/webpack to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-18T21:28:06Z","modified":"2026-10-19T07:46:02.095097497Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364766","title":"TuxCare security update for @schematics/angular (1 CVE)","description":"TuxCare rebuilt @schematics/angular to address 1 CVE. Fixed in 22.1.6-tuxcare.1.","status":"published","published":"2026-10-18T23:06:06Z","modified":"2026-10-19T07:46:05.843635705Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364767","title":"TuxCare security update for @schematics/angular (1 CVE)","description":"TuxCare rebuilt @schematics/angular to address 1 CVE. Fixed in 19.2.25-tuxcare.3.","status":"published","published":"2026-10-18T23:06:07Z","modified":"2026-10-19T07:46:07.662957691Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364768","title":"TuxCare security update for @schematics/angular (1 CVE)","description":"TuxCare rebuilt @schematics/angular to address 1 CVE. Fixed in 19.2.27-tuxcare.2.","status":"published","published":"2026-10-18T23:06:08Z","modified":"2026-10-19T07:46:06.75350589Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364769","title":"TuxCare security update for @schematics/angular (1 CVE)","description":"TuxCare rebuilt @schematics/angular to address 1 CVE. Fixed in 18.2.21-tuxcare.3.","status":"published","published":"2026-10-18T23:06:09Z","modified":"2026-10-19T07:46:06.748805911Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364771","title":"TuxCare security update for @schematics/angular (1 CVE)","description":"TuxCare rebuilt @schematics/angular to address 1 CVE. Fixed in 17.3.17-tuxcare.5.","status":"published","published":"2026-10-18T23:06:10Z","modified":"2026-10-19T07:46:16.522538912Z","updated_at":"2026-11-02T15:43:53.071325Z"}]}}