CVE-2026-104871: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

1. A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
2. The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
3. The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
4. The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
5. If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.