Angular SSR vulnerabilities

Angular SSR before versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 has a Server-Side Request Forgery (SSRF) vulnerability in request handling. The framework trusts user-controlled Host and X-Forwarded-* headers without validation, allowing attackers to direct requests to internal resources.

Angular SSR is a server-side rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. An unauthenticated requester can retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker.

Angular SSR (package @angular/ssr) before versions 19.2.18, 20.3.6, and 21.0.0-next.8 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL resolution mechanism. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\), the URL constructor treats it as a schema-relative URL, overriding the security-intended base URL (protocol, host, and port) and adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.