Angular server-side rendering and HTTP client flaws (multiple)

Angular, a web app building tool, lets attackers stop servers or send users to other sites.

Summary

Angular has flaws in server-side rendering (SSR), redirect handling, and HTTP requests that can stop a server, send users to another site, or leak a token. Developers and operators of web apps built with the affected Angular versions are affected.

Affected when

Server-side rendering (SSR) enabled on Node.js
Empty-path route or named outlet in use
Upstream infrastructure forwards the request target
SSR worker with a constrained heap
XSRF protection enabled in the HTTP client

What to do

Update to Angular 20.3.34 or later, 21.2.25 or later, or 22.2.1 or later.

Products and platforms

angular

CVE IDs

CVE-2026-111752 (opens in a new tab)
CVE-2026-111754 (opens in a new tab)
CVE-2026-111753 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-03 20:52 UTC

First seen 2026-11-09 15:20 UTC