PT-2026-47289 · Npm · @Angular/Platform-Server
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@angular/platform-server versions prior to 19.2.23
@angular/platform-server versions prior to 20.3.22
@angular/platform-server versions prior to 21.2.15
@angular/platform-server versions prior to 22.0.0-rc.2
Description
An issue in the
@angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This is caused by a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a request contains a malformed URL with a double port structure, such as http://evil.com:80:80/path, the strict URL.canParse(url) logic returns false, skipping host check validation. Subsequently, the Domino internal parser accepts the URL and resolves the origin to http://evil.com:80. The SSR HTTP request interceptor relativeUrlsTransformerInterceptorFn() then resolves relative backend HTTP requests against this origin, enabling a Server-Side Request Forgery (SSRF) attack. This can lead to the redirection of API queries containing sensitive credentials, session cookies, and internal authorization tokens to an attacker-controlled server, as well as response injection and content poisoning within the rendered HTML.Recommendations
Update to version 19.2.23 or later.
Update to version 20.3.22 or later.
Update to version 21.2.15 or later.
Update to version 22.0.0-rc.2 or later.
Exploit
Fix
Origin Validation Error
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Angular/Platform-Server