CVE-2026-88056: Angular platform-server SSRF via URL resolution discrepancy

CVE-2026-88056 · Severity: high · CVSS 4 · Published 2026-09-10

Angular's server-side rendering library (platform-server) contains a flaw that allows attackers to bypass origin validation checks and trigger server-side requests to attacker-controlled servers. An attacker can craft a URL with hidden Unicode whitespace characters that passes the application's same-origin security check but is then normalized differently by Angular's URL handler, causing it to be routed to an attacker's server instead. If the server attaches authentication credentials (like API keys or tokens) to these requests, an attacker can steal those credentials.

Technologies: @angular/platform-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-88056 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88056 being exploited in the wild.
How severe is CVE-2026-88056?
High severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?
@angular/platform-server (npm) SEMVER:introduced=22.0.0,fixed=22.1.4.
Is there a fix for CVE-2026-88056?
Yes. @angular/platform-server (npm): upgrade to 22.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88056 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88056?
Check whether you run @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/platform-server (npm): upgrade to 22.1.4 or later
    npm install @angular/platform-server@22.1.4

Technical details

The vulnerability stems from a mismatch in how URLs are validated versus how they are processed in Angular's server-side rendering. When applications validate URLs using the WHATWG URL standard (`new URL(input, trustedOrigin)`), Unicode whitespace characters (U+00A0, U+FEFF) are preserved and treated as part of a same-origin path, allowing validation to succeed. However, Angular's `@angular/platform-server` URL resolution utilities (`resolveUrl` / `parseUrl`) call `String.prototype.trim()`, which strips all Unicode whitespace, inadvertently converting a same-origin relative path into a protocol-relative URL (`//attacker.example/collect`). During server-side rendering (e.g., in `relativeUrlsTransformerInterceptorFn`), this converted URL is resolved to an attacker-controlled origin, dispatching HTTP requests with server-side credentials (Authorization headers, API keys, Bearer tokens) to the attacker. Attack requires a vulnerable Angular SSR application where user input influences resource URLs, same-origin checks are applied, and credentials are attached to requests. Patches are available in v20.3.30, v21.2.22, v22.1.4, and versions 19.2.25 and earlier are unsupported.

Affected products

  • Google @angular/platform-server >= 22.0.0, < 22.1.4
  • Google @angular/platform-server >= 21.0.0, < 21.2.22
  • Google @angular/platform-server >= 20.0.0, < 20.3.30
  • Google @angular/platform-server <= 19.2.25

Identifiers

  • CVE-2026-88056
  • GHSA-f6mr-pjwc-34m4

Timeline

  • 2026-09-10: disclosed: Published to GitHub Advisory Database
  • 2026: patched: Patches released: v20.3.30, v21.2.22, v22.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.