Executive brief
Angular is a popular development framework used to build web and mobile applications. A security flaw in its server-side rendering component allows attackers to trick the server into making requests to malicious external websites instead of intended internal ones. This could lead to the exposure of sensitive internal data, such as private API keys or configuration services, potentially compromising the security of the entire hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the @angular/platform-server package due to improper validation of request URLs in the server-side rendering (SSR) engine. When an absolute URL (e.g., http://evil.com) is passed to rendering entry points like renderModule or renderApplication, the internal ServerPlatformLocation adopts the attacker-controlled domain as the 'current' hostname. This causes subsequent relative HttpClient requests or PlatformLocation.hostname references to be redirected to the attacker's server. An unauthenticated remote attacker can exploit this to intercept internal requests or access sensitive metadata services. The issue is resolved by introducing an 'allowedHosts' configuration option to validate hostnames before rendering.
Affected products
- Google Angular >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14
Timeline
- 2026-05-05: other: Fix pull request submitted
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date