A flaw in Angular SSR’s validation of the X-Forwarded-Prefix header allows an attacker to inject a single backslash that is interpreted as a forward slash by the framework, causing a protocol-relative URL to appear in the Location header. This redirects users to an attacker‑controlled domain. Because the response lacks a Vary header for the X-Forwarded-Prefix header, the malicious redirect can be stored in intermediate caches, expanding the reach of the attack through web cache poisoning.

Angular CLI applications built with the 22.x branch before 22.0.0-next.2, the 21.x branch before 21.2.3, and the 20.x branch before 20.3.21 are vulnerable. Upgrading to 22.0.0-next.2, 21.2.3, or 20.3.21 respectively resolves the issue.

The CVSS base score of 6.9 indicates a moderate to high risk. Direct exploitation requires control of the X-Forwarded-Prefix header, which is typically possible only when the SSR application is exposed behind a proxy or load balancer. The likelihood of exploitation is not quantified in the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the combination of an open redirect and cache poisoning increases its potential impact.