CVE-2026-27739: Angular SSR SSRF and header injection in request handling

CVE-2026-27739 · Severity: medium · CVSS 4 · Published 2026-02-25

Angular's server-side rendering (SSR) framework fails to validate HTTP headers like Host and X-Forwarded-* when reconstructing application URLs. An attacker can manipulate these headers to redirect server-side requests to arbitrary external servers or internal network endpoints, potentially stealing credentials, accessing internal databases, or probing cloud metadata endpoints. This affects applications using Angular SSR with relative URLs or custom URL construction.

Technologies: @angular/ssr (npm), @nguniversal/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-27739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27739 being exploited in the wild.
How severe is CVE-2026-27739?
Medium severity, with a CVSS score of 4, published 25 February 2026.
Which products and versions are affected?
@angular/ssr (npm) SEMVER:introduced=21.2.0-next.0,fixed=21.2.0-rc.1; @nguniversal/common (npm) SEMVER:introduced=0,last_affected=16.2.0; @nguniversal/express-engine (npm) SEMVER:introduced=0,last_affected=16.2.0.
Is there a fix for CVE-2026-27739?
Yes. @angular/ssr (npm): upgrade to 21.2.0-rc.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27739 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27739?
Check whether you run @angular/ssr (npm), @nguniversal/common (npm) or @nguniversal/express-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/ssr (npm): upgrade to 21.2.0-rc.1 or later
    npm install @angular/ssr@21.2.0-rc.1

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) and header injection flaw in Angular SSR's request handling pipeline. The root cause is that Angular's URL reconstruction logic directly trusts user-controlled HTTP headers (Host, X-Forwarded-Host, X-Forwarded-Port) without validating the destination domain, sanitizing path segments or special characters, or verifying port values are numeric. An attacker on the network can manipulate these headers to steer implicit relative URL resolution (via HttpClient) or explicit URL construction (via the REQUEST object) to attacker-controlled servers or internal services. The vulnerability requires the application to use Angular SSR, perform requests using relative URLs or manually construct URLs from unvalidated headers, and be reachable by an attacker who can inject headers (e.g., lack of upstream validation by CDN/load balancer). Patches are available in versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21; workarounds include using absolute URLs and implementing middleware-level header validation.

Affected products

  • Angular @angular/ssr 21.2.0-next.0 to before 21.2.0-rc.1; 21.0.0-next.0 to before 21.1.5; 20.0.0-next.0 to before 20.3.17; 19.0.0-next.0 to before 19.2.21; 18.2.21 and earlier
  • Angular @nguniversal/common up to 16.2.0
  • Angular @nguniversal/express-engine up to 16.2.0

Identifiers

  • CVE-2026-27739
  • GHSA-x288-3778-4hhx

Timeline

  • 2026-02-25: disclosed
  • 2026-02-25: patched: Patches available: 21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.