CVE-2026-46417: Angular Platform Server SSRF Vulnerability

CVE-2026-46417 Overview

CVE-2026-46417 is a Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server, the Angular package responsible for server-side rendering (SSR). The flaw allows attackers to manipulate the ServerPlatformLocation by supplying an absolute-form URL to the rendering entry points. Once accepted, the SSR engine adopts the attacker-controlled domain as the current hostname, redirecting relative HttpClient requests and PlatformLocation.hostname references to attacker-controlled infrastructure. The vulnerability affects Angular versions prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22. Attackers can leverage this issue to reach internal APIs or cloud metadata services from the rendering server.

Critical Impact
Attackers can redirect server-side relative HTTP requests to arbitrary external hosts, exposing internal APIs and cloud metadata endpoints from SSR contexts.

Affected Products

Angular @angular/platform-server versions prior to 22.0.0-next.12
Angular @angular/platform-server versions prior to 21.2.13
Angular @angular/platform-server versions prior to 20.3.21 and 19.2.22

Discovery Timeline

2026-06-22 - CVE-2026-46417 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-46417

Vulnerability Analysis

The vulnerability resides in how Angular's SSR engine processes request URLs provided to rendering entry points. When the application accepts an externally influenced URL and passes it as the url parameter to the rendering function, the engine parses the absolute-form URL and updates the internal ServerPlatformLocation. This update changes the hostname considered authoritative during the render cycle. Any subsequent relative HTTP call issued through HttpClient resolves against the attacker-supplied origin instead of the legitimate application origin. The flaw is classified under CWE-918: Server-Side Request Forgery.

Root Cause

The root cause is insufficient validation of absolute-form URLs passed to the SSR rendering entry points. Angular's ServerPlatformLocation treats the supplied URL as trusted state and propagates the hostname into downstream HTTP resolution. Developers commonly forward incoming request URLs into the renderer without filtering the host component, which enables the injection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the SSR endpoint with an absolute-form URL pointing to an attacker-controlled host, such as http://evil.com/page. The SSR engine processes this URL and emits subsequent relative HttpClient requests against the malicious host. Attackers can also pivot to internal targets like http://169.254.169.254/ to harvest cloud metadata credentials. Refer to the GitHub Security Advisory GHSA-rfh7-fxqc-q52v for technical detail.

Detection Methods for CVE-2026-46417

Indicators of Compromise

Outbound HTTP requests from SSR worker processes to unexpected external domains or IP addresses.
SSR access logs containing absolute-form URLs in the request line where only path-form URLs are expected.
Requests from SSR hosts to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.

Detection Strategies

Inspect SSR application logs for PlatformLocation.hostname values that differ from the configured production hostname.
Compare the Host header against the request-target URI host in reverse proxy logs to identify absolute-form URL injection attempts.
Audit deployed @angular/platform-server versions across CI/CD pipelines and lockfiles to confirm patched releases are in use.

Monitoring Recommendations

Enable egress network monitoring on SSR pods or hosts to alert on connections to non-allowlisted destinations.
Instrument the SSR bootstrap function to log the resolved hostname for every render request.
Forward SSR and reverse-proxy telemetry to a centralized analytics pipeline for correlation with outbound DNS and HTTP activity.

How to Mitigate CVE-2026-46417

Immediate Actions Required

Upgrade @angular/platform-server to 22.0.0-next.12, 21.2.13, 20.3.21, or 19.2.22 depending on your release branch.
Validate the request URL on the reverse proxy and strip absolute-form URIs before they reach the Node.js SSR process.
Restrict egress from SSR hosts to a strict allowlist of legitimate backend services.

Patch Information

The Angular team has fixed the issue in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22. The corrective change is tracked in Angular GitHub Pull Request #68570 and documented in the GitHub Security Advisory GHSA-rfh7-fxqc-q52v.

Workarounds

Sanitize the url parameter passed to the SSR rendering entry point so only the path and query components are forwarded.
Configure the reverse proxy or load balancer to reject HTTP requests using absolute-form request-targets except for explicit proxy use cases.
Pin HttpClient requests in SSR code paths to absolute URLs derived from a server-side configuration constant rather than PlatformLocation.

bash

# Configuration example: upgrade to patched Angular releases
npm install @angular/platform-server@21.2.13 --save
# or for the v20 branch
npm install @angular/platform-server@20.3.21 --save
# or for the v19 branch
npm install @angular/platform-server@19.2.22 --save