AIKIDO-2026-433029

TL;DR

During server side rendering, ServerPlatformLocation passes the incoming request URL to resolveUrl, which only rejects protocol relative URLs whose raw string begins with //, and it does so before WHATWG URL normalization. A URL containing a dot segment followed by extra slashes, such as /.//evil.test, bypasses that raw string check, and the resolved pathname still begins with //. When the rendered URL and the router's final location differ, @angular/ssr writes that pathname into the HTTP Location response header, so browsers follow a redirect to another origin. The fix checks the normalized pathname for a leading // after resolution and rejects it.