An Angular Server‑Side Request Forgery occurs when a crafted URL containing a backslash or protocol‑relative address is parsed by the platform‑server during rendering. The URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, making the application believe the request originates from the attacker’s domain. This causes internal HttpClient calls and location references to resolve against the attacker‑controlled host, allowing external disclosure of internal APIs or metadata services. The vulnerability is rated CVSS 8.7, indicating high severity.

Vendors and products impacted are Angular applications using the @angular/platform‑server package. Versions prior to 19.2.21, 20.3.19, 21.2.9, and 22.0.0‑next.8 are vulnerable.

The lack of an EPSS score and absence from the CISA KEV catalog suggest no widespread exploitation yet, but the high CVSS score indicates a serious potential. Attackers can embed malicious URLs in normal HTTP requests to the application; the server passes this to Angular’s rendering engine, leading to misinterpreted origin and redirected internal requests. Successful exploitation could expose sensitive internal endpoints and compromise integrity of the application’s data flow.