The Angular Server‑Side Rendering (SSR) request handling pipeline unsafely trusts the HTTP Host header and all X‑Forwarded‑* headers when reconstructing internal URLs. Because no validation is performed on the destination domain, path, or port, an attacker who can influence these headers can redirect internal requests to arbitrary internal resources. This flaw, classified as CWE‑918, allows credential exfiltration, internal network scanning, and accidental disclosure of sensitive information, effectively creating a confidentiality breach. The vulnerability exists only when Angular SSR is in use and the application performs HttpClient requests using relative URLs or manually constructs URLs from the unvalidated request headers.

Applications built with Angular Server‑Side Rendering that depend on the packages @nguniversal/common, @nguniversal/express‑engine, or angular‑cli are affected. Versions prior to 21.2.0‑rc.1, 21.1.5, 20.3.17, and 19.2.21 are insecure. The flaw surfaces when the application runs on a server reachable by an attacker who can inject custom Host or X‑Forwarded‑* headers and when associated front‑end infrastructure (CDN, load balancer, or proxy) does not sanitize these headers.

The CVSS score of 9.2 marks this issue as high‑severity, and an EPSS score below 1% indicates that, at present, active exploitation attempts are rare. The flaw is not listed in the CISA KEV catalog, suggesting limited exploitation activity to date. The likely attack vector is an attacker sending HTTP requests with crafted Host or X-Forwarded headers to the SSR application through a web server or proxy that fails to strip or normalize these headers. An attacker would need network access that allows header manipulation, making some configurations less vulnerable if strict header validation is enforced upstream. If exploited, the attacker gains the ability to target internal services, steal credentials, or gather network topology information. Maintaining the unvalidated headers in the request pipeline is the critical weakness that facilitates this attack.