CVE-2026-46417: Angular SSR Server-Side Request Forgery Vulnerability

Technical summary

CVE-2026-46417 is a Server-Side Request Forgery (SSRF) vulnerability in Angular's @angular/platform-server affecting SSR workflows. The root cause lies in improper validation of absolute-form URLs passed to rendering entry points. When the ServerPlatformLocation is initialized with an attacker-supplied absolute URL (e.g., http://evil.com), it adopts that hostname as the "current" origin. This origin poisoning affects both dynamic HttpClient requests and PlatformLocation.hostname property access, causing them to resolve against the attacker's domain rather than the legitimate application hostname. The vulnerability is classified as CWE-918 (Server-Side Request Forgery). CVSS v3.1 score is 6.1 (MEDIUM) with network-accessible attack surface, no privileges required, and low complexity; user interaction is required and scope is changed.

Business impact

Organizations running Angular applications with server-side rendering are exposed to data exfiltration and reconnaissance attacks. If an application accepts user-controlled input for URL initialization during SSR, an attacker can intercept API responses, steal session tokens, access internal metadata services, or harvest service discovery information. The practical impact depends on whether the vulnerable code path is exposed to untrusted input. Applications with strict URL validation or those not accepting dynamic URLs in SSR initialization face minimal risk. However, any SSR application that processes user-supplied URLs—whether through query parameters, request headers, or indirect mechanisms—should be treated as potentially vulnerable.

Affected systems

The vulnerability affects Angular versions prior to: 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22. Any organization using @angular/platform-server in these branches and versions is in scope. Versions 22.0.0-next.12 and later, 21.2.13 and later, 20.3.21 and later, and 19.2.22 and later contain the fix. Organizations on older major versions (pre-19) should verify support status with Angular's release calendar, as extended maintenance may not apply.

Exploitability

Exploitation requires user interaction and the ability to control or influence the URL passed to the SSR rendering engine. This is most likely via a query parameter, header, or indirect URL source that the application uses during initialization. The attack surface is network-accessible (no authentication required to send a malicious URL), and the technical complexity is low. However, the attacker cannot directly trigger exploitation without assistance from a victim or misconfiguration; a user must click a link or the application must accept untrusted input. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update @angular/platform-server to patched versions: 22.0.0-next.12 or later, 21.2.13 or later, 20.3.21 or later, or 19.2.22 or later. Before updating, audit your SSR initialization code to identify where URLs are sourced. If any code path accepts user-controlled or externally-influenced URLs during rendering initialization, add explicit validation to ensure only expected hostnames are accepted. Consider implementing a URL allowlist for SSR entry points. After patching, re-test SSR workflows, particularly any that previously relied on dynamic URL handling.

Patch guidance

Upgrade @angular/platform-server within your Angular application's dependencies. Use npm or yarn to update the package, e.g., npm install @angular/[email protected] (or the appropriate patched version for your current major version). Ensure your package-lock.json or yarn.lock is updated and dependencies are reinstalled. Test the SSR build and runtime behavior in a staging environment before production deployment. If you are on an unsupported version (pre-19), prioritize a full Angular major version upgrade as part of your remediation plan.

Detection guidance

Review SSR initialization code for any acceptance of external URLs. Search your codebase for renderModule, renderModuleFactory, or other platform-server entry points that accept platformConfig or similar parameters. Log and monitor the URLs being passed to SSR rendering calls in production. Implement logging of PlatformLocation.hostname values during SSR to detect unexpected domain substitution. Network intrusion detection rules should flag outbound HTTP requests from your SSR server to unexpected or internal-only hostnames, particularly if correlated with unusual API patterns.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability enables reconnaissance and data theft from applications that expose URL parameters to SSR initialization. The low attack complexity and network accessibility make it a practical target for attackers if the vulnerability is exposed in your application's threat model. Prioritization should increase if you: (1) accept any user-controlled input in URL initialization, (2) expose internal APIs or metadata services accessible from your SSR server, or (3) store sensitive data in memory during rendering. Organizations with strict input validation or fully isolated SSR instances should still patch but may deprioritize relative to other medium-risk items.

Risk score, explained

The CVSS v3.1 base score of 6.1 reflects network accessibility and low attack complexity, offset by the requirement for user interaction and limited confidentiality/integrity impact (C:L, I:L). The score does not account for the potential for information disclosure of internal services or tokens if an attacker successfully redirects requests. Organizations relying on SSR should consider context-specific risk elevation if their applications accept dynamic URLs or expose sensitive internal endpoints from the rendering tier.

Frequently asked questions