CVE-2025-62427 Overview
CVE-2025-62427 is a Server-Side Request Forgery (SSRF) vulnerability in Angular's Server-Side Rendering package (@angular/ssr). The flaw resides in the createRequestUrl function, which relies on the native URL constructor to resolve incoming request paths. When a request path begins with // or \\, the constructor treats it as a schema-relative URL and adopts an attacker-controlled hostname. This overrides the security-intended base URL passed as the second argument. Subsequent relative HTTP requests issued during SSR resolve against the attacker's domain. The vulnerability affects @angular/ssr versions prior to 19.2.18, 20.3.6, and 21.0.0-next.8.
Critical Impact
Attackers can force Angular SSR servers to issue HTTP requests to arbitrary external endpoints, enabling data exfiltration, internal network reconnaissance, and supply of malicious content into rendered pages.
Affected Products
- @angular/ssr versions prior to 19.2.18
- @angular/ssr versions prior to 20.3.6
- @angular/ssr versions prior to 21.0.0-next.8
Discovery Timeline
- 2025-10-16 - CVE-2025-62427 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-62427
Vulnerability Analysis
The vulnerability is classified under CWE-918: Server-Side Request Forgery. Angular SSR renders application content on the server before delivering it to the browser. During this process, the framework builds a request URL from the incoming HTTP request to determine the page's virtual location.
The createRequestUrl function constructs URLs by invoking new URL(path, baseUrl). The native URL constructor follows WHATWG URL parsing rules. When path starts with // or \\, the parser interprets it as a protocol-relative reference. The result inherits only the scheme from baseUrl and replaces the host with whatever follows the leading slashes. An attacker who controls originalUrl or url can therefore steer the virtual location toward an external domain.
Once the virtual location is poisoned, any component performing relative HTTP requests during SSR — for example HttpClient.get('assets/data.json') — resolves the target against the attacker-controlled host. The server then issues outbound HTTP traffic to the attacker's domain. The same poisoned value propagates through DOCUMENT and PlatformLocation tokens, affecting any logic that depends on the current origin.
Root Cause
The root cause is unsafe trust placed in the native URL constructor's two-argument form. Angular SSR assumes the second argument acts as an authoritative base. The WHATWG specification grants protocol-relative paths precedence over the base host, so attacker-supplied input silently overrides the intended origin.
Attack Vector
An unauthenticated remote attacker sends an HTTP request to an Angular SSR endpoint with a path beginning with //attacker.example.com/. The SSR runtime constructs the virtual location using the attacker's hostname. Any subsequent relative HttpClient call inside the rendered route triggers an outbound request to the attacker's server, completing the SSRF chain.
The vulnerability mechanism is described in the Angular Security Advisory GHSA-q63q-pgmf-mxhr and the corresponding commit fixing the URL resolution logic.
Detection Methods for CVE-2025-62427
Indicators of Compromise
- HTTP request paths arriving at SSR endpoints with leading double-slash (//) or backslash (\\) sequences followed by an external hostname.
- Outbound HTTP connections from Node.js SSR processes to unexpected destinations, particularly during initial page render.
- Server-side rendered HTML containing assets or data sourced from domains that do not match the application origin.
Detection Strategies
- Inspect access logs and reverse proxy logs for request URIs matching the pattern ^/{2,}[^/] or containing \\ characters.
- Monitor SSR worker processes for outbound DNS resolutions and HTTPS connections to hosts outside the application's allowlist.
- Compare the package manifest (package.json, package-lock.json) against the patched versions of @angular/ssr to identify exposed builds.
Monitoring Recommendations
- Configure web application firewall rules to flag or block requests where the path component begins with multiple slashes.
- Enable egress filtering on SSR hosts and alert on connections to hosts not on a maintained allowlist.
- Aggregate Node.js process telemetry into a centralized logging platform and create detections for anomalous outbound destinations.
How to Mitigate CVE-2025-62427
Immediate Actions Required
- Upgrade @angular/ssr to version 19.2.18, 20.3.6, or 21.0.0-next.8 or later, matching your current major release line.
- Audit application code for relative HttpClient calls executed during SSR and review any logic that consumes DOCUMENT or PlatformLocation to construct outbound requests.
- Restrict egress traffic from SSR hosts to a defined allowlist of trusted backend services.
Patch Information
The Angular team released fixed versions 19.2.18, 20.3.6, and 21.0.0-next.8. The corrective change normalizes incoming paths before passing them to the URL constructor, preventing protocol-relative input from overriding the base host. See the upstream commit 5271547c for the implementation details.
Workarounds
- Place a reverse proxy in front of the SSR server and strip or reject requests whose paths begin with // or \\ before they reach Node.js.
- Normalize req.url and req.originalUrl in middleware to collapse leading slashes and remove backslashes prior to invoking the Angular SSR handler.
- Configure outbound network policies on the SSR host to deny connections to any host outside the application's required dependencies.
# Upgrade @angular/ssr to a patched release
npm install @angular/ssr@^20.3.6
# Verify the installed version
npm ls @angular/ssr
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
