CVE-2026-88056Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Updated under an hour ago ()
Does this affect you?
It affects angular. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
- CVSS
- 8.6 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Sep 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
angular angular angular:angular (from the name) | through 19.2.25; from 20.0.0, < 20.3.30; from 21.0.0, < 21.2.22; from 22.0.0, < 22.1.4 | CNA record |
angular angular angular:angular | from 19.0.0 through 19.2.25; from 20.0.0 before 20.3.30; from 21.0.0 before 21.2.22; from 22.0.0 before 22.1.4 | NVD |
References
- https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4x-refsource-confirm, exploit, mitigation, vendor-advisory
- https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034cx-refsource-misc, patch
- https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132x-refsource-misc, patch
- https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970x-refsource-misc, patch
- https://github.com/angular/angular/releases/tag/v20.3.30x-refsource-misc, release-notes
- https://github.com/angular/angular/releases/tag/v21.2.22x-refsource-misc, release-notes
- https://github.com/angular/angular/releases/tag/v22.1.4x-refsource-misc, release-notes
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.