Executive brief
Angular's server-side rendering (SSR) framework fails to validate HTTP headers like Host and X-Forwarded-* when reconstructing application URLs. An attacker can manipulate these headers to redirect server-side requests to arbitrary external servers or internal network endpoints, potentially stealing credentials, accessing internal databases, or probing cloud metadata endpoints. This affects applications using Angular SSR with relative URLs or custom URL construction.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) and header injection flaw in Angular SSR's request handling pipeline. The root cause is that Angular's URL reconstruction logic directly trusts user-controlled HTTP headers (Host, X-Forwarded-Host, X-Forwarded-Port) without validating the destination domain, sanitizing path segments or special characters, or verifying port values are numeric. An attacker on the network can manipulate these headers to steer implicit relative URL resolution (via HttpClient) or explicit URL construction (via the REQUEST object) to attacker-controlled servers or internal services. The vulnerability requires the application to use Angular SSR, perform requests using relative URLs or manually construct URLs from unvalidated headers, and be reachable by an attacker who can inject headers (e.g., lack of upstream validation by CDN/load balancer). Patches are available in versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21; workarounds include using absolute URLs and implementing middleware-level header validation.
Affected products
- Angular @angular/ssr 21.2.0-next.0 to before 21.2.0-rc.1; 21.0.0-next.0 to before 21.1.5; 20.0.0-next.0 to before 20.3.17; 19.0.0-next.0 to before 19.2.21; 18.2.21 and earlier
- Angular @nguniversal/common up to 16.2.0
- Angular @nguniversal/express-engine up to 16.2.0
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Patches available: 21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21