AIKIDO-2026-282622

@angular/platform-server is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published Yesterday

Low Risk

This Affects:

@angular/platform-server

20.3.24 - 20.3.29

Fixed in 20.3.30

21.2.16 - 21.2.21

Fixed in 21.2.22

22.1.0 - 22.1.3

Fixed in 22.1.4

Are you affected? Scan for Free

TL;DR

Angular's server-side URL parser called trim() before checking whether a URL was relative or absolute, and trim() strips Unicode whitespace characters such as non-breaking space and byte order mark. A URL string prefixed with one of these characters followed by // was converted into a protocol-relative URL, bypassing the same-origin check Angular's HTTP client uses to keep server-side requests on the expected origin. This let a URL that should resolve to the local origin instead resolve to an externally-controlled origin during server-side rendering. The fix removes the trim() call so such inputs are treated as inert relative paths on the original origin.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes externally-influenced URL strings into an HTTP request made during server-side rendering.