Angular @nguniversal/express-engine vulnerabilities

• angular @nguniversal/common, @nguniversal/express-engine, angular-cli +2 more Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline CVE-2026-27739 Public exploitFix available 9.2 CriticalFebruary 25, 2026