Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Angular server-side rendering may send credentials to attacker

CVE-2026-88056 · published 1 month ago
Summary

If you are using Angular’s server‑side rendering feature in versions before the latest updates, the code can be tricked into sending requests to a site you did not intend. When this happens, any sensitive authentication information that the server adds to those requests can be exposed to the attacker. Update Angular to the newest releases to stop this behavior.

What to do
  • Update angular platform-server to version 22.1.4.
  • Update angular platform-server to version 21.2.22.
  • Update angular platform-server to version 20.3.30.
  • Update angular @angular/platform-server to version 22.1.4.
  • Update angular @angular/platform-server to version 21.2.22.
  • Update angular @angular/platform-server to version 20.3.30.
Affected software
Ecosystem VendorProductAffected versions
– angular angular <= 19.2.25
>= 19.0.0, <= 19.2.25
>= 20.0.0, < 20.3.30
>= 21.0.0, < 21.2.22
>= 22.0.0, < 22.1.4
npm angular platform-server >= 22.0.0, < 22.1.4
>= 21.0.0, < 21.2.22
>= 20.0.0, < 20.3.30
<= 19.2.25
Fix: upgrade to 22.1.4
npm angular @angular/platform-server >= 22.0.0, < 22.1.4
>= 21.0.0, < 21.2.22
>= 20.0.0, < 20.3.30
<= 19.2.25
Fix: upgrade to 22.1.4
Debian:12 debian angular.js All versions
Ubuntu:Pro:16.04:LTS canonical angular.js All versions
Original advisory text
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published10 Sep 2026
Updated11 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-88056 · NVD
CVE-2026-88056 · MITRE
GHSA-f6mr-pjwc-34m4 · GHSA
GHSA-f6mr-pjwc-34m4 · OSV
CVE-2026-88056 · OSV
DEBIAN-CVE-2026-88056 · OSV
UBUNTU-CVE-2026-88056 · OSV
Track software like this
Free during beta