CVE-2026-33397

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

CVE-2026-33397 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: SNYK:JS-ANGULARSSR-15701178...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-33397 via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

@hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.16-exui-4425-rel1) potentially affected by CVE-2026-33397 via @angular/ssr (20.3.18)

@angular/ssr NPM version 20.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @hmcts/media-viewer =4.2.16-exui-4425, =4.2.16-exui-4425-rel1 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

create-momentum-app (>=0.1.2, <=0.5.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (21.1.2)

@angular/ssr NPM version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - create-momentum-app =0.1.2, =0.5.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: OSV:GHSA-XH43-G2FQ-WJRJ...