CVE-2026-88056

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Published Sep 10, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

Analysis

Technical impact

Angular Server‑Side Rendering was able to process user‑controlled URLs via HttpClient after validating them with WHATWG URL parsing. During URL resolution, a trim operation removed leading Unicode whitespace after a same‑origin check, turning a relative path into a protocol‑relative attacker‑controlled URL. If the application attached sensitive server‑side credentials such as Authorization headers to accepted requests, the dispatcher sent the request to the attacker‑controlled origin, exposing credentials and allowing server‑side requests to arbitrary destinations.

Affected Systems

All Angular applications that use @angular/platform-server before version 20.3.30, 21.2.22, or 22.1.4 are vulnerable. This includes any application built with Angular that performs URL resolution for server‑side rendering and may forward request headers.

Risk and Exploitability

The CVSS score of 8.6 classifies this flaw as high severity. EPSS data is not available, but the vulnerability is exploitable without special conditions; the attacker merely needs to influence a user‑controlled URL. The attack path involves manipulating the URL string, causing the application to resolve and send a request to an external host while sending internal credentials, leading to potential data exfiltration or remote command execution on the target server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`<= 19.2.25`	affected	—
`>= 20.0.0, < 20.3.30`	affected	—
`>= 21.0.0, < 21.2.22`	affected	—
`>= 22.0.0, < 22.1.4`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*

No data.

Vendor Product Versions

Angular

Version	Status	Scheme	Platform
`[0,19.2.25]`	affected	semver	—
`[20.0.0,20.3.30)`	affected	semver	—
`[21.0.0,21.2.22)`	affected	semver	—
`[22.0.0,22.1.4)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Angular to the fixed versions (20.3.30, 21.2.22, or 22.1.4 or later).
If an upgrade is not immediately possible, remove or prevent Transmission oftrusted URLs in SSR.
As a temporary measure, restrict outbound traffic from the Angular server so that SSRF requests cannot reach external networks.

Generated by OpenCVE AI on September 10, 2026 at 22:58 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-f6mr-pjwc-34m4	Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.541% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
https://github.com/angular/angular/releases/tag/v20.3.30
https://github.com/angular/angular/releases/tag/v21.2.22
https://github.com/angular/angular/releases/tag/v22.1.4
https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4

History

Sep 29, 2026 7:15 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:angular:angular::::::node.js::*
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Sep 15, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Sep 10, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Title		Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Weaknesses		CWE-918
References		https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132 https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970 https://github.com/angular/angular/releases/tag/v20.3.30 https://github.com/angular/angular/releases/tag/v21.2.22 https://github.com/angular/angular/releases/tag/v22.1.4 https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`