Angular SSR CVE-2025-62427

Exploitation requires (1) the target to run @angular/ssr in a vulnerable range (>=19.0.0-next.0 and <19.2.18, >=20.0.0-next.0 and <20.3.6, or >=21.0.0-next.0 and <21.0.0-next.8), (2) the SSR application to actually issue relative HTTP requests during server-side rendering (e.g. HttpClient.get('assets/data.json') or 'api/data'), and (3) the request path beginning with '//' or '\\' to reach createRequestUrl without normalization. The key limiting factors: applications that make no relative server-side fetches have little to steal via this flaw, and any reverse proxy/load balancer that collapses leading double slashes to a single slash neutralizes the attack before it reaches Angular. No authentication or user interaction is required (PR:N/UI:N), so default vulnerable deployments behind a non-normalizing proxy are exposed to remote unauthenticated SSRF.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 8.7 (High) is driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality impact (VC:H) and no integrity or availability impact. However, several signals temper the urgency: EPSS is only 0.43% (35th percentile), indicating low modeled probability of near-term mass exploitation; the vulnerability is NOT listed in CISA KEV; and no public weaponized exploit code was identified - the advisory provides only a conceptual proof-of-concept request (http://localhost:4200//attacker-domain.com/...). The SSVC-style read is that technical impact is partial (SSRF/confidentiality only, no RCE), and automatability is limited because successful exploitation depends on the specific application actually issuing relative HttpClient requests during SSR and on front-end proxies forwarding unnormalized // paths. The high CVSS and the real confidentiality exposure (DOCUMENT/PlatformLocation poisoning leading to server-side requests toward attacker endpoints) make patching worthwhile, but the low EPSS and absence of KEV/public exploit suggest this is a prompt-patch item rather than a drop-everything incident. No conflicting-signal problems in the CVSS itself: the network vector is consistent with the description of a request-path-driven SSRF.

An unauthenticated remote attacker sends a request to a vulnerable Angular SSR endpoint with a path beginning with a double slash, e.g. http://victim-app//attacker-domain.com/some-page. The URL constructor treats this as schema-relative, so the SSR engine adopts attacker-domain.com as the virtual host; any relative request the application makes during rendering (such as HttpClient.get('api/data')) is then resolved to http://attacker-domain.com/api/data, forcing the server to contact the attacker's endpoint. No public exploit code exists, but the GitHub advisory documents a concrete conceptual PoC request.