{"schema_version":1,"title":"@angular/platform-server (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in @angular/platform-server (npm): 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111754, was published on 3 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/angular-platform-server","json_url":"https://junglewise.ai/threats/technologies/angular-platform-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/angular-platform-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":10,"all_time":12,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":5,"last_365_days":11},"latest":[{"cve":"CVE-2026-111754","cvss":4,"slug":"cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls","title":"Angular platform-server open redirect via protocol-relative URLs in SSR","severity":"medium","exploited":false,"published_at":"2026-11-03T21:16:58.203+00:00","url":"https://junglewise.ai/threats/cve-2026-111754-angular-platform-server-open-redirect-via-protocol-relative-urls"},{"cve":"CVE-2026-101895","cvss":4,"epss":0.0072,"slug":"cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed","title":"Angular platform-server denial of service via malformed DOCTYPE","severity":"high","exploited":false,"published_at":"2026-10-14T15:17:03.37+00:00","url":"https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed"},{"cve":"CVE-2026-88060","cvss":4,"epss":0.0076,"slug":"cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in","title":"Angular platform-server SSR XSS via unescaped template in fallback elements","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:42.107+00:00","url":"https://junglewise.ai/threats/cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in"},{"cve":"CVE-2026-88058","cvss":4,"epss":0.0088,"slug":"cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom","title":"Angular platform-server XSS via ProcessingInstruction DOM serialization","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:41.8+00:00","url":"https://junglewise.ai/threats/cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom"},{"cve":"CVE-2026-88056","cvss":4,"epss":0.0061,"slug":"cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy","title":"Angular platform-server SSRF via URL resolution discrepancy","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:41.477+00:00","url":"https://junglewise.ai/threats/cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy"},{"cve":"CVE-2026-69149","cvss":4,"epss":0.0035,"slug":"cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements","title":"Angular SSR XSS in fallback raw-content elements","severity":"high","exploited":false,"published_at":"2026-08-03T16:14:43+00:00","url":"https://junglewise.ai/threats/cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements"},{"cve":"CVE-2026-50556","cvss":4,"epss":0.0041,"slug":"cve-2026-50556-angular-xss-in-platform-server-noscript-serialization","title":"Angular XSS in platform-server noscript serialization","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:43.19+00:00","url":"https://junglewise.ai/threats/cve-2026-50556-angular-xss-in-platform-server-noscript-serialization"},{"cve":"CVE-2026-50555","cvss":3.1,"epss":0.0027,"slug":"cve-2026-50555-google-angular-xss-in-angular-platform-server-via-domino","title":"Google Angular XSS in @angular/platform-server via domino serialization","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:43.057+00:00","url":"https://junglewise.ai/threats/cve-2026-50555-google-angular-xss-in-angular-platform-server-via-domino"},{"cve":"CVE-2026-50168","cvss":3.1,"epss":0.0024,"slug":"cve-2026-50168-google-angular-ssrf-allowlist-bypass-in-platform-server","title":"Google Angular SSRF allowlist bypass in platform-server","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:42.117+00:00","url":"https://junglewise.ai/threats/cve-2026-50168-google-angular-ssrf-allowlist-bypass-in-platform-server"},{"cve":"CVE-2026-46417","cvss":3.1,"epss":0.0036,"slug":"cve-2026-46417-google-angular-ssrf-in-angular-platform-server","title":"Angular @angular/platform-server SSRF via Hostname Hijacking","severity":"high","exploited":false,"published_at":"2026-05-19T20:29:49+00:00","url":"https://junglewise.ai/threats/cve-2026-46417-google-angular-ssrf-in-angular-platform-server"},{"cve":"CVE-2026-41423","cvss":5.3,"epss":0.0048,"slug":"cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular","title":"Google Angular SSRF in @angular/platform-server via URL normalization","severity":"high","exploited":false,"published_at":"2026-05-08T14:16:33.26+00:00","url":"https://junglewise.ai/threats/cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular"},{"cve":"CVE-2025-59052","cvss":4,"epss":0.0034,"slug":"cve-2025-59052-angular-server-side-rendering-race-condition-in-platform-injector","title":"Angular Server-Side Rendering race condition in platform injector","severity":"medium","exploited":false,"published_at":"2025-09-10T21:56:01+00:00","url":"https://junglewise.ai/threats/cve-2025-59052-angular-server-side-rendering-race-condition-in-platform-injector"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"openclaw (npm)","slug":"npm-openclaw","vulnerabilities":214,"url":"https://junglewise.ai/threats/technologies/npm-openclaw"},{"name":"flowise (npm)","slug":"flowise","vulnerabilities":133,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":111,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"electron (npm)","slug":"electron","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/electron"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"n8n (npm)","slug":"npm-n8n","vulnerabilities":64,"url":"https://junglewise.ai/threats/technologies/npm-n8n"},{"name":"hono (npm)","slug":"hono","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"directus (npm)","slug":"directus","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"undici (npm)","slug":"undici","vulnerabilities":53,"url":"https://junglewise.ai/threats/technologies/undici"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/budibase-server"}],"technology":{"hub":true,"name":"@angular/platform-server (npm)","slug":"angular-platform-server","vendor":{"hub":true,"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://angular.io/","repo_url":"https://github.com/angular/angular","description":"Angular package for server-side rendering of Angular applications.","url":"https://junglewise.ai/threats/technologies/angular-platform-server"},"most_severe":[{"cve":"CVE-2026-41423","cvss":5.3,"epss":0.0048,"slug":"cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular","title":"Google Angular SSRF in @angular/platform-server via URL normalization","severity":"high","exploited":false,"published_at":"2026-05-08T14:16:33.26+00:00","url":"https://junglewise.ai/threats/cve-2026-41423-angular-ssrf-via-protocol-relative-and-backslash-urls-in-angular"},{"cve":"CVE-2026-88058","cvss":4,"epss":0.0088,"slug":"cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom","title":"Angular platform-server XSS via ProcessingInstruction DOM serialization","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:41.8+00:00","url":"https://junglewise.ai/threats/cve-2026-88058-angular-platform-server-xss-via-processinginstruction-dom"},{"cve":"CVE-2026-88060","cvss":4,"epss":0.0076,"slug":"cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in","title":"Angular platform-server SSR XSS via unescaped template in fallback elements","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:42.107+00:00","url":"https://junglewise.ai/threats/cve-2026-88060-angular-platform-server-ssr-xss-via-unescaped-template-in"},{"cve":"CVE-2026-101895","cvss":4,"epss":0.0072,"slug":"cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed","title":"Angular platform-server denial of service via malformed DOCTYPE","severity":"high","exploited":false,"published_at":"2026-10-14T15:17:03.37+00:00","url":"https://junglewise.ai/threats/cve-2026-101895-angular-ssr-denial-of-service-dos-via-infinite-loop-on-malformed"},{"cve":"CVE-2026-88056","cvss":4,"epss":0.0061,"slug":"cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy","title":"Angular platform-server SSRF via URL resolution discrepancy","severity":"high","exploited":false,"published_at":"2026-09-10T19:17:41.477+00:00","url":"https://junglewise.ai/threats/cve-2026-88056-angular-platform-server-ssrf-via-url-resolution-discrepancy"},{"cve":"CVE-2026-50556","cvss":4,"epss":0.0041,"slug":"cve-2026-50556-angular-xss-in-platform-server-noscript-serialization","title":"Angular XSS in platform-server noscript serialization","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:43.19+00:00","url":"https://junglewise.ai/threats/cve-2026-50556-angular-xss-in-platform-server-noscript-serialization"},{"cve":"CVE-2026-69149","cvss":4,"epss":0.0035,"slug":"cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements","title":"Angular SSR XSS in fallback raw-content elements","severity":"high","exploited":false,"published_at":"2026-08-03T16:14:43+00:00","url":"https://junglewise.ai/threats/cve-2026-69149-angular-ssr-xss-in-fallback-raw-content-elements"},{"cve":"CVE-2026-46417","cvss":3.1,"epss":0.0036,"slug":"cve-2026-46417-google-angular-ssrf-in-angular-platform-server","title":"Angular @angular/platform-server SSRF via Hostname Hijacking","severity":"high","exploited":false,"published_at":"2026-05-19T20:29:49+00:00","url":"https://junglewise.ai/threats/cve-2026-46417-google-angular-ssrf-in-angular-platform-server"},{"cve":"CVE-2026-50555","cvss":3.1,"epss":0.0027,"slug":"cve-2026-50555-google-angular-xss-in-angular-platform-server-via-domino","title":"Google Angular XSS in @angular/platform-server via domino serialization","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:43.057+00:00","url":"https://junglewise.ai/threats/cve-2026-50555-google-angular-xss-in-angular-platform-server-via-domino"},{"cve":"CVE-2026-50168","cvss":3.1,"epss":0.0024,"slug":"cve-2026-50168-google-angular-ssrf-allowlist-bypass-in-platform-server","title":"Google Angular SSRF allowlist bypass in platform-server","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:42.117+00:00","url":"https://junglewise.ai/threats/cve-2026-50168-google-angular-ssrf-allowlist-bypass-in-platform-server"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}