8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41423

CVE-2026-41423: Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR).

When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions.

Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.

Affected APIs:

renderModule
renderApplication
CommonEngine (from @angular/ssr)

Non-Affected APIs:

AngularAppEngine (from @angular/ssr)
AngularNodeAppEngine (from @angular/ssr)

Attack Preconditions

The server has outbound network access.
The application uses Angular SSR via the affected APIs.
A pathname is passed as URL to the rendering method (e.g. using req.url).
The server-side code performs HTTP requests using HttpClient with relative URLs or uses PlatformLocation.hostname to build URLs.

Patches

22.0.0-next.8
21.2.9
20.3.19
19.2.21

Workarounds

Developers should implement a middleware to sanitize the request URL before it reaches Angular. This involves stripping or normalizing leading slashes:

app.use((req, res, next) => {
  // Sanitize the URL to ensure it starts with a single forward slash
  if (req.url.startsWith('//') || req.url.startsWith('/\\') || req.url.startsWith('\\')) {
     req.url = '/' + req.url.replace(/^[/\\]+/, '');
  }
  next();
});

References

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41423

CVE-2026-41423:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/platform-server	npm	>= 22.0.0-next.0, < 22.0.0-next.8	22.0.0-next.8
@angular/platform-server	npm	>= 21.0.0-next.0, < 21.2.9	21.2.9
@angular/platform-server	npm	>= 20.0.0-next.0, < 20.3.19	20.3.19
@angular/platform-server	npm	>= 19.0.0-next.0, < 19.2.21	19.2.21
@angular/platform-server	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Angular's @angular/platform-server package. The root cause lies in the parseUrl function within packages/platform-server/src/location.ts. This function used the standard URL constructor (new URL(url, base)) to parse URLs for server-side rendering. According to the WHATWG specification, if the url parameter is a protocol-relative URL (e.g., //example.com) or a URL starting with backslashes (/\example.com), it can override the hostname of the base URL.

An attacker could send a crafted request to the server (e.g., GET //attacker.com/), and the server-side rendering engine would pass this URL to Angular. The ServerPlatformLocation class, specifically in its constructor and replaceState methods, would call the vulnerable parseUrl function. This would cause Angular to treat attacker.com as the application's origin.

Consequently, any subsequent server-side HttpClient requests made with relative URLs would be sent to the attacker's server instead of the intended backend API. This could lead to the leakage of sensitive information or the exploitation of internal services.

The patch fixes this by modifying the parseUrl function to prepend the origin to any URL that starts with a /, effectively treating it as a path relative to the origin and preventing the hostname from being overridden. The key vulnerable functions that would appear in a runtime profile are parseUrl itself, and the methods that call it with user-controlled input, namely the constructor and replaceState methods of the ServerPlatformLocation class.

Vulnerable functions

parseUrl

packages/platform-server/src/location.ts

The original `parseUrl` function was vulnerable to SSRF because it used `new URL(urlStr, origin)` directly. A malicious `urlStr` like `//evil.com` could override the hostname of the `origin`, causing subsequent relative API calls to be directed to an attacker-controlled server. This function is the root cause of the vulnerability.

ServerPlatformLocation.constructor

packages/platform-server/src/location.ts

The constructor for `ServerPlatformLocation` is a primary entry point for the vulnerability. During Server-Side Rendering, it's called with the request URL (`config.url`). It then passes this URL to the vulnerable `parseUrl` function, which can lead to the application's internal state being hijacked with a malicious origin.

ServerPlatformLocation.replaceState

packages/platform-server/src/location.ts

The `replaceState` method, used for updating the server-side history, also serves as an entry point for the vulnerability. It calls the vulnerable `parseUrl` function with a `newUrl` parameter. If an attacker can control this parameter, they can trigger the SSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.