A flaw in the X-Forwarded-Prefix header handling of Angular Server‑Side Rendering allows an attacker to inject percent‑encoded ".." sequences that are decoded during routing, resulting in path traversal and open redirect behavior. The vulnerability is due to missing validation of encoded characters in the header, meaning that malicious payloads such as "/%2e%2e/evil" can steer the application to arbitrary internal paths or externally controlled URLs. The impact spans confidentiality, integrity, and availability where a user is redirected to unintended destinations or the application state is manipulated without authorization.

Affected versions of angular-cli are 19.0.0‑next.0 through 19.2.24, and the released versions 20.3.25, 21.2.9, and 22.0.0‑next.7 contain the fix. Any deployment of Angular SSR that trusts proxy headers and is behind a proxy that forwards X‑Forwarded‑Prefix without sanitization is vulnerable. The issue does not affect earlier releases predating Angular CLI 19.0.0‑next.0.

The CVSS score of 6.9 classifies the flaw as a medium severity vulnerability. Because EPSS data is not available, the current exploit probability is uncertain, but the known ability to drive arbitrary redirects and steering suggests a non‑negligible risk in environments that rely on trusted proxy headers. The vulnerability is not listed in the CISA KEV catalog; however, exploiting it requires the capability to inject or control the X‑Forwarded‑Prefix header, which typically means compromising the proxy or having direct access to the SSR endpoint. The attacker can then manipulate request routing for malicious purposes such as phishing, credential harvesting, or denial of service.