Angular Angular-cli vulnerabilities

• angular angular-cli Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows CVE-2026-104871 Fix available 6.3 MediumOctober 2, 2026
• angular angular-cli, cli +1 more Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVE-2026-44437 Fix available 6.9 MediumMay 6, 2026
• angular angular-cli, cli +1 more Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass CVE-2026-33397 Fix available 6.9 MediumMarch 19, 2026
• angular @nguniversal/common, @nguniversal/express-engine, angular-cli +2 more Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline CVE-2026-27739 Public exploitFix available 9.2 CriticalFebruary 25, 2026
• angular angular-cli Angular SSR has an Open Redirect via X-Forwarded-Prefix CVE-2026-27738 Fix available 6.9 MediumFebruary 25, 2026
• angular angular-cli Server-Side Request Forgery (SSRF) in Angular SSR CVE-2025-62427 Fix available 8.7 HighOctober 16, 2025