EUVD-2026-28552
GHSA-45q2-gjvg-7973
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated single-request trigger (AV:N/PR:N/UI:N); SSRF crosses into other systems so S:C with high confidentiality exposure of internal/metadata data (C:H) and minor integrity effect (I:L); AC:L reflects trivial trigger though app-coding preconditions apply.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.
AnalysisAI
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the application's perceived origin by sending a request path like GET /\evil.com/, causing the server's URL parser to normalize the backslash and treat evil.com as the local origin. Affected Angular versions prior to 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8 that render via renderModule, renderApplication, or CommonEngine then redirect relative HttpClient calls and PlatformLocation.hostname-derived URLs to the attacker's domain, potentially exposing internal APIs or cloud metadata services. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile) and it is not in CISA KEV, though a vendor patch and a documented middleware workaround are available.
Technical ContextAI
The flaw is a classic CWE-918 (SSRF) rooted in URL parsing during Angular Server-Side Rendering. Angular's platform-server component (npm @angular/platform-server) builds a ServerPlatformLocation by feeding the incoming request URL (commonly req.url from Express or a similar Node engine) into a parseUrl helper that used new URL(urlStr, origin). Per the WHATWG URL specification, backslashes are normalized to forward slashes for the special http/https schemes, so an input such as /\evil.com/ resolves to the absolute URL //evil.com/ (a protocol-relative host) rather than a path on the local origin. This corrupts the internal PlatformLocation state (hostname/protocol/href), so any code building request targets from the current origin - relative HttpClient requests or PlatformLocation.hostname references - is silently pointed at the attacker's host. The upstream fix (PR #68194, commit ede7c58) rewrites parseUrl to only concatenate origin+urlStr when the input is empty or already begins with a single forward slash, otherwise treating the string as an explicit absolute URL, closing the protocol-relative/backslash bypass. Notably the newer @angular/ssr engines AngularAppEngine and AngularNodeAppEngine are not affected - only the renderModule, renderApplication, and CommonEngine paths.
RemediationAI
Upgrade @angular/platform-server (and @angular/ssr) to the fixed release for your major version: Vendor-released patch: 19.2.21, 20.3.19, 21.2.9, or 22.0.0-next.8 (fix in PR https://github.com/angular/angular/pull/68194, commit ede7c58a2aa13fdccc8f0b67ce93ba1c11749412; advisory https://github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973). If you cannot upgrade immediately, apply the vendor-documented workaround: add Express (or equivalent) middleware ahead of the Angular renderer that normalizes the request URL to a single leading forward slash - reject or rewrite paths beginning with //, /\, or \, e.g. if (req.url.startsWith('//') || req.url.startsWith('/\\') || req.url.startsWith('\\')) req.url = '/' + req.url.replace(/^[/\\]+/, ''). Side effect: legitimate double-slash paths get collapsed, so verify no valid routes rely on them. As additional compensating controls where SSR runs in cloud infrastructure, restrict the SSR host's outbound egress and block access to the cloud metadata endpoint (169.254.169.254) so a hijacked origin cannot reach internal metadata even if triggered.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today