Skip to content
OpenAdvisories
Medium WID-SEC-2026-4339 3 CVEs

Angular: Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 3, 2026 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um einen Denial of Service Angriff durchzuführen oder Nutzer auf eine beliebige externe Website umzuleiten.

Product

Angular ist ein TypeScript-basiertes Front-End-Webapplikationsframework. Es ist eine Weiterentwicklung des JavaScript basierten AngularJS.

Vulnerabilities 3

  • High 8.2
    CVE-2026-111751

    Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTr…

    angular angular @angular/router npm
  • High 8.2
    CVE-2026-111752

    Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL s…

    angular angular @angular/router npm
  • Medium 5.1
    CVE-2026-111754

    Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URL…

    angular angular @angular/platform-server npm

Revision history

  1. #1

    Initiale Fassung

References