CVE-2026-46417: Angular @angular/platform-server SSRF via Hostname Hijacking

CVE-2026-46417 · Severity: high · CVSS 3.1 · Published 2026-05-19

Angular is a popular development framework used to build web and mobile applications. A security flaw in its server-side rendering component allows attackers to trick the server into making requests to malicious external websites instead of intended internal ones. This could lead to the exposure of sensitive internal data, such as private API keys or configuration services, potentially compromising the security of the entire hosting environment.

Technologies: Google Platform-Server, @angular/platform-server (npm). Vendors: Google, npm.

Quick answers

Is CVE-2026-46417 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46417 being exploited in the wild.
How severe is CVE-2026-46417?
High severity, with a CVSS score of 3.1, published 19 May 2026.
Which products and versions are affected?
Google Platform-Server >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14; @angular/platform-server (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.12.
Is there a fix for CVE-2026-46417?
Yes. @angular/platform-server (npm): upgrade to 22.0.0-next.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46417 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46417?
Check whether you run Google Platform-Server or @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/platform-server (npm): upgrade to 22.0.0-next.12 or later
    npm install @angular/platform-server@22.0.0-next.12

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the @angular/platform-server package due to improper validation of request URLs in the server-side rendering (SSR) engine. When an absolute URL (e.g., http://evil.com) is passed to rendering entry points like renderModule or renderApplication, the internal ServerPlatformLocation adopts the attacker-controlled domain as the 'current' hostname. This causes subsequent relative HttpClient requests or PlatformLocation.hostname references to be redirected to the attacker's server. An unauthenticated remote attacker can exploit this to intercept internal requests or access sensitive metadata services. The issue is resolved by introducing an 'allowedHosts' configuration option to validate hostnames before rendering.

Affected products

  • Google Angular >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14

Identifiers

  • CVE-2026-46417
  • GHSA-rfh7-fxqc-q52v

Timeline

  • 2026-05-05: other: Fix pull request submitted
  • 2026-05-14: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.