CVE-2026-41423: Google Angular SSRF in @angular/platform-server via URL normalization

CVE-2026-41423 · Severity: high · CVSS 5.3 · Published 2026-05-08

Angular's server-side rendering (SSR) component incorrectly processes certain malformed URLs, allowing an attacker to trick the application into believing requests are coming from a different domain. This can cause the server to make outbound HTTP requests to attacker-controlled servers, potentially exposing internal APIs, metadata services, or other sensitive backend systems. The vulnerability requires the server to have outbound network access and to pass user-supplied request paths directly to Angular's rendering functions.

Technologies: @angular/platform-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-41423 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41423 being exploited in the wild.
How severe is CVE-2026-41423?
High severity, with a CVSS score of 5.3, published 8 May 2026.
Which products and versions are affected?
@angular/platform-server (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.8.
Is there a fix for CVE-2026-41423?
Yes. @angular/platform-server (npm): upgrade to 22.0.0-next.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41423 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41423?
Check whether you run @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/platform-server (npm): upgrade to 22.0.0-next.8 or later
    npm install @angular/platform-server@22.0.0-next.8

Technical details

The vulnerability exists in the parseUrl() function within ServerPlatformLocation, which uses new URL(urlStr, origin) per WHATWG URL specification to parse incoming request URLs during SSR. Protocol-relative URLs (//evil.com) and backslash-prefixed URLs (/\evil.com) can override the hostname component of the base URL. The attack typically manifests in SSR setups (e.g., Express) where req.url is passed directly to affected APIs (renderApplication, renderModule, CommonEngine). When an attacker sends requests like GET /\evil.com/ or GET //evil.com/, the URL parser normalizes these to treat evil.com as the origin, causing all relative HttpClient requests or PlatformLocation.hostname references to redirect to the attacker's server. The vulnerability requires outbound network access on the server and specific SSR API usage patterns. Patches are available in versions 22.0.0-next.8, 21.2.9, 20.3.19, and 19.2.21; versions 18.2.14 and earlier are affected with no patch planned.

Affected products

  • Angular @angular/platform-server 22.0.0-next.0 to 22.0.0-next.7; 21.0.0-next.0 to 21.2.8; 20.0.0-next.0 to 20.3.18; 19.0.0-next.0 to 19.2.20; 0 to 18.2.14

Identifiers

  • CVE-2026-41423
  • GHSA-45q2-gjvg-7973

Timeline

  • 2026-04-16: disclosed: Advisory GHSA-45q2-gjvg-7973 published
  • 2026-04-15: patched: Fix merged in PR #68194; patches released in versions 22.0.0-next.8, 21.2.9, 20.3.19, 19.2.21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.