# CVE-2026-46417: Angular @angular/platform-server SSRF via Hostname Hijacking

Source: https://junglewise.ai/threats/cve-2026-46417-google-angular-ssrf-in-angular-platform-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-46417 · Severity: high · CVSS 3.1 · Published 2026-05-19

Angular is a popular development framework used to build web and mobile applications. A security flaw in its server-side rendering component allows attackers to trick the server into making requests to malicious external websites instead of intended internal ones. This could lead to the exposure of sensitive internal data, such as private API keys or configuration services, potentially compromising the security of the entire hosting environment.

Technologies: [Google Platform-Server](https://junglewise.ai/threats/technologies/google-angular), [@angular/platform-server (npm)](https://junglewise.ai/threats/technologies/angular-platform-server). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46417 being exploited in the wild.

**How severe is CVE-2026-46417?** High severity, with a CVSS score of 3.1, published 19 May 2026.

**Which products and versions are affected?** Google Platform-Server >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14; @angular/platform-server (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.12.

**Is there a fix for CVE-2026-46417?** Yes. @angular/platform-server (npm): upgrade to 22.0.0-next.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46417 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46417?** Check whether you run Google Platform-Server or @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/platform-server (npm): upgrade to 22.0.0-next.12 or later

  ```sh
  npm install @angular/platform-server@22.0.0-next.12
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the @angular/platform-server package due to improper validation of request URLs in the server-side rendering (SSR) engine. When an absolute URL (e.g., http://evil.com) is passed to rendering entry points like renderModule or renderApplication, the internal ServerPlatformLocation adopts the attacker-controlled domain as the 'current' hostname. This causes subsequent relative HttpClient requests or PlatformLocation.hostname references to be redirected to the attacker's server. An unauthenticated remote attacker can exploit this to intercept internal requests or access sensitive metadata services. The issue is resolved by introducing an 'allowedHosts' configuration option to validate hostnames before rendering.

## Affected products

- Google Angular >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14

## Identifiers

- CVE-2026-46417
- GHSA-rfh7-fxqc-q52v

## Timeline

- 2026-05-05: other: Fix pull request submitted
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date

## References

- [https://github.com/angular/angular/pull/68570](https://github.com/angular/angular/pull/68570)
- [https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v](https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v)

## Related threats

- [Angular platform-server open redirect via protocol-relative URLs in SSR](https://junglewise.ai/threats/cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls)
- [Angular platform-server denial of service via malformed DOCTYPE](https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed)
- [Angular platform-server SSR XSS via unescaped template in fallback elements](https://junglewise.ai/threats/cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in)
- [Angular platform-server XSS via ProcessingInstruction DOM serialization](https://junglewise.ai/threats/cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom)
- [Angular platform-server SSRF via URL resolution discrepancy](https://junglewise.ai/threats/cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy)