Executive brief
Angular's server-side rendering library (platform-server) contains a flaw that allows attackers to bypass origin validation checks and trigger server-side requests to attacker-controlled servers. An attacker can craft a URL with hidden Unicode whitespace characters that passes the application's same-origin security check but is then normalized differently by Angular's URL handler, causing it to be routed to an attacker's server instead. If the server attaches authentication credentials (like API keys or tokens) to these requests, an attacker can steal those credentials.
Technical details
The vulnerability stems from a mismatch in how URLs are validated versus how they are processed in Angular's server-side rendering. When applications validate URLs using the WHATWG URL standard (`new URL(input, trustedOrigin)`), Unicode whitespace characters (U+00A0, U+FEFF) are preserved and treated as part of a same-origin path, allowing validation to succeed. However, Angular's `@angular/platform-server` URL resolution utilities (`resolveUrl` / `parseUrl`) call `String.prototype.trim()`, which strips all Unicode whitespace, inadvertently converting a same-origin relative path into a protocol-relative URL (`//attacker.example/collect`). During server-side rendering (e.g., in `relativeUrlsTransformerInterceptorFn`), this converted URL is resolved to an attacker-controlled origin, dispatching HTTP requests with server-side credentials (Authorization headers, API keys, Bearer tokens) to the attacker. Attack requires a vulnerable Angular SSR application where user input influences resource URLs, same-origin checks are applied, and credentials are attached to requests. Patches are available in v20.3.30, v21.2.22, v22.1.4, and versions 19.2.25 and earlier are unsupported.
Affected products
- Google @angular/platform-server >= 22.0.0, < 22.1.4
- Google @angular/platform-server >= 21.0.0, < 21.2.22
- Google @angular/platform-server >= 20.0.0, < 20.3.30
- Google @angular/platform-server <= 19.2.25
Timeline
- 2026-09-10: disclosed: Published to GitHub Advisory Database
- 2026: patched: Patches released: v20.3.30, v21.2.22, v22.1.4