angular-form-validations (>=1.0.0, <=1.0.7), angular-md-table (>=1.1.9, <=1.4.0) +5 more potentially affected by unknown CVE via angular (1.5.2)

angular NPM version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - angular-form-validations =1.0.0, =1.1.9, =1.0.0, =0.2.114, =1.0.0, =1.10.0, =1.10.2 Source cves: unknown CVE Source advisory: MEND:WS-2016-0055...

marcura-ui (>=0.0.1, <=0.0.4) potentially affected by unknown CVE via angular (1.3.8)

angular NPM version 1.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - marcura-ui =0.0.1, =0.0.4 Source cves: unknown CVE Source advisory: MEND:WS-2016-0055...

angular-fng (1.0.0-rc1), funnyp (2.0.2) +3 more potentially affected by unknown CVE via angular (>=1.4.0, <=1.4.1)

angular NPM version =1.4.0, =0.1.0, =0.1.105, =0.0.2, =0.0.26 Source cves: unknown CVE Source advisory: MEND:WS-2016-0055...

apacsale.now (>=1.0.0, <=1.0.3), extends-ng-model (>=0.0.1, <=1.0.0) +6 more potentially affected by unknown CVE via angular (1.4.3)

angular NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - apacsale.now =1.0.0, =0.0.1, =0.4.6, =1.0.0, =1.1.1, =1.0.0, =0.2.31, =0.2.61 Source cves: unknown CVE Source advisory: MEND:WS-2016-0055...

@bb-cli/bb-test-plugin-ngmock (1.5.8), @getbeyond/ng-js-beyond-bootstrap (>=1.0.0, <=1.3.7) +126 more potentially affected by unknown CVE via angular (1.5.8)

angular NPM version 1.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - @bb-cli/bb-test-plugin-ngmock 1.5.8 - @getbeyond/ng-js-beyond-bootstrap =1.0.0, =1.0.0, =0.1.0, =1.0.0, =5.0.1, =1.10.0, =2.9.8, =1.7.0,...

angular-es6-seed (>=0.2.0, <=0.2.1), angular-form-messages (0.14.1) +19 more potentially affected by unknown CVE via angular (1.5.0)

angular NPM version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - angular-es6-seed =0.2.0, =1.0.0, =6.0.0, =1.1.1, =0.2.3, =1.0.0, =1.0.0, =0.0.16, =3.0.0-rc1, =1.0.0, =0.0.1, =0.2.105, =0.2.112 and more Source...

@nuskin/app-components (1.1.0), @nuskin/app-elements (>=1.0.2, <=1.22.0-cx8-297.6) +21 more potentially affected by unknown CVE via angular (1.5.6)

angular NPM version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on angular and may be impacted: - @nuskin/app-components 1.1.0 - @nuskin/app-elements =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.5-SNAPSHOT.11,...

@amitport/useful (>=0.5.0, <=0.5.2), @bb-cli/bb-test-plugin-ngmock (1.5.8) +691 more potentially affected by unknown CVE via angular (>=0.0.1, <=1.5.11)

angular NPM version =0.0.1, =0.5.0, =0.2.7, =1.0.21, =0.2.1, =1.10.5, =0.2.0, =0.2.0-dev, =1.2.6, =0.3.2, =1.0.0, =1.0.0, =3.0.2, =4.5.1 and more Source cves: unknown CVE Source advisory: MEND:WS-2018-0001...

WS-2017-0125

It was possible to run arbitrary JS from inside angular expressions using the Object.getOwnPropertyDescriptor method since commit 4ab16aa...

angular-cjk-word-break (>=0.1.0, <=0.1.1), angular-pusher-bridge (>=0.1.1, <=0.1.4) +2 more potentially affected by unknown CVE via angular (>=0.0.1, <=1.2.0)

angular NPM version =0.0.1, =0.1.0, =0.1.1, =0.0.1, =0.0.25 Source cves: unknown CVE Source advisory: MEND:WS-2017-0125...

CVE-2026-44437

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

CVE-2026-44437

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

CVE-2026-44437

Summary: CVE-2026-44437 affects Angular SSR before fixed versions 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7. The vulnerability lies in the X-Forwarded-Prefix header processing: the internal validation does not properly account for URL-encoded characters (notably dots like %2e%2e), enabling enco...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8), @manniwatch/client-desktop (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2026-44437 via @angular/ssr (>=19.0.5, <=19.2.19)

@angular/ssr NPM version =19.0.5, =1.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2026-44437 Source advisory: MEND:CVE-2026-44437...

CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

CVE-2026-44437

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-44437 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-44437 Source advisory: MEND:CVE-2026-44437...

CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

Angular path traversal vulnerability

Angular is an open-source development platform created by Angular. It is used to build mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular versions prior to 19.0.0-next.0, 20.3.25, 21.2.9, and 22.0.0-next.7 contain a path traversal vulnerability. This...