chore(deps): update dependency @angular/ssr to v20.3.36 [security] by renovate[bot] · Pull Request #2512 · ngxs/store

renovate · 2026-10-13T08:39:24Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/ssr	`20.3.28` → `20.3.36`

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

CVE-2026-104871 / GHSA-7g7c-h8rr-7p6q

More information

Details

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.

Impact

This vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:

Information Disclosure: Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app app-admin adjacent to app) can be accessed by unauthorized users.
Limited Scope: Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.

Attack Preconditions

The application must use CommonEngine from @angular/ssr/node (or @angular/ssr in v17–v18).
The application must be hosted on Windows (where Node's path.join resolves \ as a path separator).
The application passes a relative request URL (such as req.url or req.originalUrl without origin) into CommonEngine.render({ url }).
A sibling directory exists whose name starts with the same prefix as the configured publicPath directory (e.g., dist\app-admin alongside dist\app).
The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.

Affected Versions

>= 22.0.0, < 22.1.7
>= 21.0.0, < 21.2.23
>= 20.0.0, < 20.3.36
<= 19.2.27

Patches

22.1.7
21.2.23
20.3.36

Versions <= 19.2.27 have reached End of Support / LTS expiration and will not be patched.

Workarounds

Until a patch is applied, developers using CommonEngine on Windows can sanitize request URLs in server.ts before passing them to CommonEngine.render, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:

server.use((req, res, next) => {
  const { protocol, originalUrl, headers } = req;

  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)
  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\/g, '/')}`;

  commonEngine
    .render({
      bootstrap,
      documentFilePath: indexHtml,
      url: sanitizedUrl,
      publicPath: distFolder,
    })
    .then((html) => res.send(html))
    .catch((err) => next(err));
});

Alternatively, migrate from the deprecated CommonEngine to AngularNodeAppEngine, which relies on manifest-based route matching rather than direct filesystem path resolution.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular-cli (@angular/ssr)

`v20.3.36`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
b4059cdc7	fix	update less to 4.9.0

@angular/ssr

Commit	Type	Description
c3e5982e4	fix	ensure public directory containment in CommonEngine

`v20.3.35`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
94b620acd7	fix	update webpack-dev-server to 5.2.6

`v20.3.34`

Compare Source

@angular/cli

Commit	Type	Description
3962517b9	fix	update dependency @modelcontextprotocol/sdk to v1.30.0

@angular-devkit/build-angular

Commit	Type	Description
f348efe8b	fix	bump undici to 7.29.0

`v20.3.33`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
0b4008f17d	fix	upgrade postcss to 8.5.23

@angular/build

Commit	Type	Description
fc861affcd	fix	upgrade postcss to 8.5.23

`v20.3.32`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
d4e07cb3e	fix	update http-proxy-middleware to 3.0.7

`v20.3.31`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
4ea787cd0	fix	bump undici to 7.28.0

@angular/build

Commit	Type	Description
df5a2cc2b	fix	bump vite to 7.3.6

`v20.3.30`

Compare Source

@angular/build

Commit	Type	Description
36adca99c	fix	bump @babel/core to 7.29.7
7f236cfea	fix	bump esbuild to 0.28.1
94fb3c122	fix	bump piscina to 5.2.0
1f283a41c	fix	bump vite to 7.3.5

`v20.3.29`

Compare Source

@angular/cli

Commit	Type	Description
5f7c0328c	fix	update pacote to 21.5.1

@angular/ssr

Commit	Type	Description
a75d78e68	fix	prioritize options over environment variables in AngularNodeAppEngine

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

nx-cloud · 2026-10-13T08:42:16Z

View your CI Pipeline Execution ↗ for commit 8f25995

Command	Status	Duration	Result
`nx run-many --target=test --all --configuration...`	✅ Succeeded	16s	View ↗
`nx lint-types store`	✅ Succeeded	<1s	View ↗
`nx run-many --target=lint --all --configuration...`	✅ Succeeded	1s	View ↗
`nx run-many --target=build --all`	✅ Succeeded	1m 9s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-10-13 08:45:40 UTC

pkg-pr-new · 2026-10-13T08:43:26Z

Open in StackBlitz

@ngxs/devtools-plugin

npm i https://pkg.pr.new/@ngxs/devtools-plugin@2512

@ngxs/form-plugin

npm i https://pkg.pr.new/@ngxs/form-plugin@2512

@ngxs/hmr-plugin

npm i https://pkg.pr.new/@ngxs/hmr-plugin@2512

@ngxs/router-plugin

npm i https://pkg.pr.new/@ngxs/router-plugin@2512

@ngxs/storage-plugin

npm i https://pkg.pr.new/@ngxs/storage-plugin@2512

@ngxs/store

npm i https://pkg.pr.new/@ngxs/store@2512

@ngxs/websocket-plugin

npm i https://pkg.pr.new/@ngxs/websocket-plugin@2512

commit: 8f25995

bundlemon · 2026-10-13T08:48:43Z

BundleMon

Unchanged files (6)

Status	Path	Size	Limits
❌	fesm2022/ngxs-store.mjs	131.38KB	118KB / +0.5%
❌	fesm2022/ngxs-store-operators.mjs	16.81KB	16KB / +0.5%
✅	fesm2022/ngxs-store-internals.mjs	14.85KB	15KB / +0.5%
✅	fesm2022/ngxs-store-internals-testing.mjs	10.33KB	13KB / +0.5%
❌	fesm2022/ngxs-store-plugins.mjs	5.39KB	3KB / +0.5%
✅	fesm2022/ngxs-store-experimental.mjs	574B	2KB / +0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	@ngxs/store(fesm2022)[gzip] _{./fesm2022/*.mjs}	45.92KB	+1%

Final result: ❌

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-10-13T08:48:45Z

BundleMon (NGXS Plugins)

Unchanged files (9)

Status	Path	Size	Limits
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin.m js}	6.1KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin.mjs}	4.5KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{hmr-plugin/fesm2022/ngxs-hmr-plugin.mjs}	2.78KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{websocket-plugin/fesm2022/ngxs-websocket-plug in.mjs}	2.61KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{form-plugin/fesm2022/ngxs-form-plugin.mjs}	2.51KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{devtools-plugin/fesm2022/ngxs-devtools-plugin .mjs}	2.26KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{logger-plugin/fesm2022/ngxs-logger-plugin.mjs}	2.07KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{storage-plugin/fesm2022/ngxs-storage-plugin-i nternals.mjs}	1.21KB	+0.5%
✅	Plugins(fesm2022)[gzip] _{router-plugin/fesm2022/ngxs-router-plugin-int ernals.mjs}	453B	+0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	All Plugins(fesm2022)[gzip] _{./-plugin/fesm2022/.mjs}	24.48KB	+0.5%

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

bundlemon · 2026-10-13T08:48:47Z

BundleMon (Integration Projects)

Unchanged files (1)

Status	Path	Size	Limits
✅	Main bundles(Gzip) _{hello-world-ng22/dist-integration/browser/mai n-(hash).js}	69.48KB	+1%

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

chore(deps): update dependency @angular/ssr to v20.3.36 [security]

8f25995

renovate Bot requested a review from markwhitfeld as a code owner October 13, 2026 08:39

renovate Bot enabled auto-merge (squash) October 13, 2026 08:39

renovate Bot requested review from Carniatto, arturovt, joaqcid, kuncevic, poloagustin and splincode as code owners October 13, 2026 08:39

Navigation Menu

Repository navigation

chore(deps): update dependency @angular/ssr to v20.3.36 [security] - #2512

chore(deps): update dependency @angular/ssr to v20.3.36 [security]#2512
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-angular-ssr-vulnerability

renovate Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 13, 2026

Uh oh!

bundlemon Bot commented Oct 13, 2026

Uh oh!

bundlemon Bot commented Oct 13, 2026

Uh oh!

bundlemon Bot commented Oct 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

Details

Impact

Attack Preconditions

Affected Versions

Patches

Workarounds

Severity

References

Release Notes

Configuration

Uh oh!

nx-cloud Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 13, 2026

Uh oh!

bundlemon Bot commented Oct 13, 2026

BundleMon

Uh oh!

bundlemon Bot commented Oct 13, 2026

BundleMon (NGXS Plugins)

Uh oh!

bundlemon Bot commented Oct 13, 2026

BundleMon (Integration Projects)

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 13, 2026 •

edited

Loading

nx-cloud Bot commented Oct 13, 2026 •

edited

Loading