Angular versions prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22 allow a Server-Side Request Forgery through server‑side rendering. An attacker injects an absolute URL (e.g., http://evil.com) into the rendering entry point, causing the SSR engine to treat the attacker’s domain as the active hostname. Consequently, any relative HTTP client calls or hostname references are redirected to the attacker’s server, exposing internal services or sensitive metadata. The flaw is an instance of CWE‑918.

Any application built with Angular 22.0.0-next.12 or earlier, 21.2.13 or earlier, 20.3.21 or earlier, or 19.2.22 or earlier, that employs server‑side rendering and accepts external URLs as rendering parameters is vulnerable. The issue resides specifically in the @angular/platform-server package.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, but the absence of a CISA KEV listing suggests no known public exploits yet. Nonetheless, the flaw can be leveraged remotely with minimal effort if an attacker can supply a rendering request, making it a high‑impact risk for exposed SSR endpoints.