CVE-2026-46417: Angular: SSRF via Hostname Hijacking in @angular/platform-server
Impact
A Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points.
When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname.
Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.
Fix Information The vulnerability is mitigated by introducing an Allowlist Mechanism directly into the core rendering APIs. The renderModule and renderApplication functions now include an allowedHosts configuration option. The rendering engine validates the hostname extracted from the request URL against this list before proceeding. If the hostname does not match an allowed entry, the engine prevents the hostname hijacking, ensuring that HttpClient requests remain restricted to trusted domains.
Patches - 22.0.0-next.12 - 21.2.13 - 20.3.21 - 19.2.22
Workarounds Developers unable to update immediately should implement strict URL validation in their server entry point (e.g., server.ts). Ensure that req.url is validated against a known list of trusted hostnames or normalized to a relative path before being passed torenderApplication or renderModule.
TypeScript // Example manual normalization in Express app.get('', (req, res, next) => { const trustedHost = 'localhost:4000'; // Ensure the request target matches expectations if (req.headers.host !== trustedHost) { return res.status(403).send('Forbidden'); } next(); });
Other sources
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@angular/platform-serverto a version that resolves this vulnerability.Fixed in 19.2.22 - Upgrade
Upgrade
npm/@angular/platform-serverto a version that resolves this vulnerability.Fixed in 20.3.21 - Upgrade
Upgrade
npm/@angular/platform-serverto a version that resolves this vulnerability.Fixed in 21.2.13 - Upgrade
Upgrade
npm/@angular/platform-serverto a version that resolves this vulnerability.Fixed in 22.0.0-next.12 - Upgrade
Upgrade
@angular/platform-serverto a version that resolves this vulnerability.Fixed in 19.2.22 - Upgrade
Upgrade
@angular/platform-serverto a version that resolves this vulnerability.Fixed in 20.3.21 - Upgrade
Upgrade
@angular/platform-serverto a version that resolves this vulnerability.Fixed in 21.2.13 - Upgrade
Upgrade
@angular/platform-serverto a version that resolves this vulnerability.Fixed in 22.0.0-next.12 - Configuration
Update to a fixed release and configure the server-side rendering entry points to use the allowedHosts configuration option so the rendering engine validates the hostname extracted from the request URL before proceeding (introduced in the patched versions, for renderModule and renderApplication).
Angular Universal SSR engine (@angular/platform-server) allowedHosts (renderApplication/renderModule) = <set allowedHosts to a known list of trusted hostnames> - Configuration
For developers unable to update immediately, implement strict URL validation in the server entry point (e.g., server.ts): ensure req.url is validated against a known list of trusted hostnames or normalized to a relative path before being passed to renderApplication or renderModule; the engine prevents hostname hijacking when the hostname does not match an allowed entry.
Server entry point (e.g., server.ts) req.url normalization/validation before renderApplication/renderModule = Validate req.url against a known list of trusted hostnames or normalize to a relative path (deny/stop if hostname not allowed)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46417?
CVE-2026-46417 is classified as a medium-severity vulnerability due to its potential for exploitation through server-side request forgery (SSRF).
How do I fix CVE-2026-46417?
To remediate CVE-2026-46417, upgrade the @angular/platform-server package to version 19.2.22 or higher.
Which versions of @angular/platform-server are affected by CVE-2026-46417?
Affected versions of @angular/platform-server range from 18.2.14 and below, prior to the fixes in versions 19.2.22, 20.3.21, 21.2.13, and 22.0.0-next.12.
What types of attacks can CVE-2026-46417 facilitate?
CVE-2026-46417 can be exploited to conduct server-side request forgery attacks, potentially allowing attackers to access internal resources.
Is there a specific patch or version that resolves CVE-2026-46417?
Yes, updating @angular/platform-server to version 19.2.22 or above addresses the vulnerability identified as CVE-2026-46417.