CVE-2026-88056: angular Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-88056 is a critical (CVSS 9.1) Server-Side Request Forgery (SSRF) vulnerability in angular. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.