AIKIDO-2025-10730
@angular/ssr is vulnerable to Server-Side Request Forgery (SSRF)
46
Medium Risk
This Affects:
@angular/ssrTL;DR
Affected versions of this package are vulnerable to server-side request forgery (SSRF) because createRequestUrl uses new URL(originalUrl ?? url, base) and allows schema-relative paths (//host) to override the base. An attacker can craft a request path beginning with // (e.g. //attacker.com/path), causing Angular SSR to treat the request as coming from http://attacker.com and perform relative requests against attacker-controlled hosts. This enables SSRF, domain spoofing, and potential content injection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/ssr is vulnerable to Server-Side Request Forgery (SSRF) in versions 19.0.0 - 19.2.17 and 20.0.0 - 20.3.5.
How to fix this
Upgrade the @angular/ssr library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant