CVE-2025-62427

35th percentile - higher than 35% of all known CVEs

Angular SSR (package @angular/ssr) before versions 19.2.18, 20.3.6, and 21.0.0-next.8 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL resolution mechanism. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\), the URL constructor treats it as a schema-relative URL, overriding the security-intended base URL (protocol, host, and port) and adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.

An attacker could exploit this vulnerability to perform SSRF attacks, potentially leading to unauthorized access to internal network resources, data leakage, or using the server as a proxy to attack other systems.

Update the @angular/ssr package to version 19.2.18, 20.3.6, or 21.0.0-next.8 (or later). Also consider validating and sanitizing URL paths in SSR applications.