Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-41423: Angular platform-server can be tricked into contacting attacker
CVE-2026-41423 · published 6 months ago
Summary
Versions of Angular’s platform-server before the latest releases can be fooled into treating an attacker‑controlled domain as its own. This can cause the server to send internal data or API calls to the attacker’s site. Updating Angular to the newest versions fixes the issue.
What to do
- Update angular @angular/platform-server to version 22.0.0-next.8.
- Update angular @angular/platform-server to version 21.2.9.
- Update angular @angular/platform-server to version 20.3.19.
- Update angular @angular/platform-server to version 19.2.21.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | angular.js | All versions |
| Debian:12 | debian | angular.js | All versions |
| Debian:13 | debian | angular.js | All versions |
| Debian:14 | debian | angular.js | All versions |
| npm | angular | @angular/platform-server |
>= 22.0.0-next.0, < 22.0.0-next.8 >= 21.0.0-next.0, < 21.2.9 >= 20.0.0-next.0, < 20.3.19 >= 19.0.0-next.0, < 19.2.21 <= 18.2.14 Fix: upgrade to 22.0.0-next.8
|
| – | angular | angular |
< 19.2.21 >= 20.0.0, < 20.3.19 >= 21.0.0, < 21.2.9 22.0.0 cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | angular.js | All versions |
Original advisory text
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41423 Vendor Advisory
- https://github.com/angular/angular Product
- https://github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973 Third Party Advisory
- https://github.com/angular/angular/pull/68194 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-41423 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-41423 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41423 Third Party Advisory
- https://github.com/angular/angular/commit/ede7c58a2aa13fdccc8f0b67ce93ba1c117494... Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published8 May 2026
Updated4 Nov 2026
First seen8 May 2026
Sources
CVE-2026-41423 · NVD
GHSA-45q2-gjvg-7973 · OSV
DEBIAN-CVE-2026-41423 · OSV
UBUNTU-CVE-2026-41423 · OSV
Track software like this
Free during beta