CVE-2026-27739
CriticalSummary
Angular SSR before versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 has a Server-Side Request Forgery (SSRF) vulnerability in request handling. The framework trusts user-controlled Host and X-Forwarded-* headers without validation, allowing attackers to direct requests to internal resources.
Risk Assessment
The risk includes credential exfiltration, internal network probing, and confidentiality breach. The attack can be performed remotely without authentication.
Recommendation
Update Angular SSR to patched versions immediately. Additionally, restrict trust in Host and X-Forwarded-* headers and implement destination validation.
Other vulnerabilities in Angular SSR
See all- CVE-2026-104871Medium
Angular SSR is a server-side rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. An unauthenticated requester can retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker.
- CVE-2026-44437Medium
Vulnerability in Angular SSR from 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 in X-Forwarded-Prefix header processing. The validation mechanism fails to account for URL-encoded characters, specifically dots (%2e%2e), allowing bypass of security filters via encoded path traversal sequences.
- CVE-2025-62427High
Angular SSR (package @angular/ssr) before versions 19.2.18, 20.3.6, and 21.0.0-next.8 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL resolution mechanism. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\), the URL constructor treats it as a schema-relative URL, overriding the security-intended base URL (protocol, host, and port) and adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.
Original NVD description (English source)
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the destination domain. Specifically, the framework didn't have checks for the host domain, path and character sanitization, and port validation. This vulnerability manifests in two primary ways: implicit relative URL resolution and explicit manual construction. When successfully exploited, this vulnerability allows for arbitrary internal request steering. This can lead to credential exfiltration, internal network probing, and a confidentiality breach. In order to be vulnerable, the victim application must
Vulnerability data from NVD (NIST) · CISA KEV · EPSS