# CVE-2025-62427: Angular SSR server-side request forgery in URL resolution

Source: https://junglewise.ai/threats/cve-2025-62427-angular-ssr-server-side-request-forgery-in-url-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-62427 · Severity: medium · CVSS 4 · Published 2025-10-16

Angular SSR (Server-Side Rendering) is a framework component that renders web pages on the server before sending them to clients. A flaw in its URL handling allows attackers to forge requests to arbitrary external servers by crafting malicious URLs starting with double slashes, causing the server to fetch data from attacker-controlled domains instead of legitimate sources. This can lead to unauthorized data access, server-side request interception, and potential lateral movement within network infrastructure.

Technologies: [@angular/ssr (npm)](https://junglewise.ai/threats/technologies/angular-ssr). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-62427 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62427 being exploited in the wild.

**How severe is CVE-2025-62427?** Medium severity, with a CVSS score of 4, published 16 October 2025.

**Which products and versions are affected?** @angular/ssr (npm) SEMVER:introduced=19.0.0-next.0,fixed=19.2.18.

**Is there a fix for CVE-2025-62427?** Yes. @angular/ssr (npm): upgrade to 19.2.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62427 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-62427?** Check whether you run @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/ssr (npm): upgrade to 19.2.18 or later

  ```sh
  npm install @angular/ssr@19.2.18
  ```


## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the createRequestUrl function of @angular/ssr's URL resolution mechanism. The function uses the native JavaScript URL constructor with an attacker-controlled path; when the path begins with "//" or "\\", the URL constructor interprets it as schema-relative, overriding the intended base URL (protocol, host, port) and instead resolving relative to an attacker-specified hostname. This allows an attacker to inject external domains via requests like "http://localhost:4200//attacker-domain.com/some-page", causing subsequent relative requests (e.g., "api/data") to resolve to "http://attacker-domain.com/api/data". The vulnerability affects @angular/ssr versions 19.0.0-next.0 through 19.2.17, 20.0.0-next.0 through 20.3.5, and 21.0.0-next.0 through 21.0.0-next.7. Patches are available in versions 19.2.18, 20.3.6, and 21.0.0-next.8. Workaround: sanitize incoming request paths to remove leading double slashes via server-side middleware.

## Affected products

- Google @angular/ssr >=19.0.0-next.0 <19.2.18, >=20.0.0-next.0 <20.3.6, >=21.0.0-next.0 <21.0.0-next.8

## Identifiers

- CVE-2025-62427
- GHSA-q63q-pgmf-mxhr

## Timeline

- 2025-10-16: disclosed

## References

- [https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr](https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr)

## Related threats

- [Angular SSR path traversal via backslash on Windows](https://junglewise.ai/threats/cve-2026-104871-the-angular-ssr-is-a-server-rise-rendering-tool-for-angular)
- [Angular SSR path traversal in X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-44437-angular-ssr-path-traversal-in-x-forwarded-prefix-header)
- [Angular SSR protocol-relative URL injection via backslash bypass](https://junglewise.ai/threats/cve-2026-33397-angular-ssr-protocol-relative-url-injection-via-backslash-bypass)
- [Angular SSR SSRF and header injection in request handling](https://junglewise.ai/threats/cve-2026-27739-angular-ssr-ssrf-and-header-injection-in-request-handling)
- [Angular SSR open redirect via X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-27738-angular-ssr-open-redirect-via-x-forwarded-prefix-header)