CVE-2026-46417

Angular: SSRF via Hostname Hijacking in @angular/platform-server

Published Jun 22, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22.

Analysis

Technical impact

Angular versions prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22 allow a Server-Side Request Forgery through server‑side rendering. An attacker injects an absolute URL (e.g., http://evil.com) into the rendering entry point, causing the SSR engine to treat the attacker’s domain as the active hostname. Consequently, any relative HTTP client calls or hostname references are redirected to the attacker’s server, exposing internal services or sensitive metadata. The flaw is an instance of CWE‑918.

Affected Systems

Any application built with Angular 22.0.0-next.12 or earlier, 21.2.13 or earlier, 20.3.21 or earlier, or 19.2.22 or earlier, that employs server‑side rendering and accepts external URLs as rendering parameters is vulnerable. The issue resides specifically in the @angular/platform-server package.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, but the absence of a CISA KEV listing suggests no known public exploits yet. Nonetheless, the flaw can be leveraged remotely with minimal effort if an attacker can supply a rendering request, making it a high‑impact risk for exposed SSR endpoints.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`>= 22.0.0-next.0, < 22.0.0-next.12`	affected	—
`>= 21.0.0-next.0, < 21.2.13`	affected	—
`>= 20.0.0-next.0, < 20.3.21`	affected	—
`>= 19.0.0-next.0, < 19.2.22`	affected	—
`<= 18.2.14`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next0::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next1::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next10::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next11::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next2::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next3::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next4::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next5::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next6::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next7::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next8::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next9::::node.js::*

No data.

Vendor Product Versions

Angular

Version	Status	Scheme	Platform
`[22.0.0-next.0,22.0.0-next.12)`	affected	semver	—
`[21.0.0-next.0,21.2.13)`	affected	semver	—
`[20.0.0-next.0,20.3.21)`	affected	semver	—
`[19.0.0-next.0,19.2.22)`	affected	semver	—
`[0,18.2.14]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Angular to 22.0.0-next.12 or later, 21.2.13 or later, 20.3.21 or later, or 19.2.22 or later.
Validate or reject absolute-form URLs before they reach the SSR engine; enforce that only relative URLs or whitelisted domains are accepted.
Configure your HTTP client or server to reject outbound requests to untrusted hosts, and document that internal APIs should not be reachable through dynamically supplied hostnames.

Generated by OpenCVE AI on June 22, 2026 at 18:26 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rfh7-fxqc-q52v	@angular/platform-server: SSRF via Hostname Hijacking

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.361% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-46417
https://bugzilla.redhat.com/show_bug.cgi?id=2491444
https://github.com/angular/angular/pull/68570
https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v
https://nvd.nist.gov/vuln/detail/CVE-2026-46417
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46417.json
https://www.cve.org/CVERecord?id=CVE-2026-46417

History

Jun 30, 2026 12:45 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-46417 https://www.cve.org/CVERecord?id=CVE-2026-46417
Metrics	threat_severity `None`	threat_severity `Important`

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Jun 22, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22.
Title		Angular: SSRF via Hostname Hijacking in @angular/platform-server
Weaknesses		CWE-918
References		https://github.com/angular/angular/pull/68570 https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N'}`