PT-2026-41374 · Npm · @Angular/Platform-Server

Published 2026-05-15 · Updated 2026-05-20 · CVE-2026-46417

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions @angular/platform-server versions prior to 22.0.0-next.12 @angular/platform-server versions prior to 21.2.13 @angular/platform-server versions prior to 20.3.21 @angular/platform-server versions prior to 19.2.22

Description A Server-Side Request Forgery (SSRF) issue exists in the server-side rendering (SSR) engine due to the way request URLs provided to rendering entry points are processed. When an absolute-form URL is passed, the internal ServerPlatformLocation can be manipulated to adopt an attacker-controlled domain as the current hostname. This allows relative HttpClient requests or PlatformLocation.hostname references to be redirected to a malicious server, which may expose internal APIs or metadata services.

Recommendations Update to version 22.0.0-next.12. Update to version 21.2.13. Update to version 20.3.21. Update to version 19.2.22. Implement strict URL validation in the server entry point to ensure req.url is validated against trusted hostnames or normalized to a relative path before being passed to renderApplication() or renderModule() functions.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46417

GHSA-RFH7-FXQC-Q52V

Affected Products

@Angular/Platform-Server

References · 6

• https://osv.dev/vulnerability/GHSA-rfh7-fxqc-q52v · Vendor Advisory
• https://github.com/angular/angular/pull/68570 · Note
• https://github.com/angular/angular · Note
• https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v · Note
• https://reddit.com/r/VulnMatter/comments/1tiopdo/resumen_diario_de_vulnerabilidades_20052026 · Reddit Post
• https://twitter.com/AliDevEgy/status/2055345177724625236 · Twitter Post