CVE-2025-62427: Angular SSR server-side request forgery in URL resolution

CVE-2025-62427 · Severity: medium · CVSS 4 · Published 2025-10-16

Angular SSR (Server-Side Rendering) is a framework component that renders web pages on the server before sending them to clients. A flaw in its URL handling allows attackers to forge requests to arbitrary external servers by crafting malicious URLs starting with double slashes, causing the server to fetch data from attacker-controlled domains instead of legitimate sources. This can lead to unauthorized data access, server-side request interception, and potential lateral movement within network infrastructure.

Technologies: @angular/ssr (npm). Vendors: npm.

Quick answers

Is CVE-2025-62427 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62427 being exploited in the wild.
How severe is CVE-2025-62427?
Medium severity, with a CVSS score of 4, published 16 October 2025.
Which products and versions are affected?
@angular/ssr (npm) SEMVER:introduced=19.0.0-next.0,fixed=19.2.18.
Is there a fix for CVE-2025-62427?
Yes. @angular/ssr (npm): upgrade to 19.2.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62427 attacked?
It is attacked over the network.
Am I affected by CVE-2025-62427?
Check whether you run @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/ssr (npm): upgrade to 19.2.18 or later
    npm install @angular/ssr@19.2.18

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the createRequestUrl function of @angular/ssr's URL resolution mechanism. The function uses the native JavaScript URL constructor with an attacker-controlled path; when the path begins with "//" or "\\", the URL constructor interprets it as schema-relative, overriding the intended base URL (protocol, host, port) and instead resolving relative to an attacker-specified hostname. This allows an attacker to inject external domains via requests like "http://localhost:4200//attacker-domain.com/some-page", causing subsequent relative requests (e.g., "api/data") to resolve to "http://attacker-domain.com/api/data". The vulnerability affects @angular/ssr versions 19.0.0-next.0 through 19.2.17, 20.0.0-next.0 through 20.3.5, and 21.0.0-next.0 through 21.0.0-next.7. Patches are available in versions 19.2.18, 20.3.6, and 21.0.0-next.8. Workaround: sanitize incoming request paths to remove leading double slashes via server-side middleware.

Affected products

  • Google @angular/ssr >=19.0.0-next.0 <19.2.18, >=20.0.0-next.0 <20.3.6, >=21.0.0-next.0 <21.0.0-next.8

Identifiers

  • CVE-2025-62427
  • GHSA-q63q-pgmf-mxhr

Timeline

  • 2025-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.