CVE-2026-88056
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
How to fix
- angular angular20.3.30, 21.2.22, 22.1.4 or later
- @angular/platform-server22.1.4, 21.2.22, 20.3.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| angular angular | 19.0.0 ≤ v ≤ 19.2.25, 20.0.0 ≤ v < 20.3.30, 21.0.0 ≤ v < 21.2.22, 22.0.0 ≤ v < 22.1.4 | 20.3.30, 21.2.22, 22.1.4 |
| @angular/platform-servernpm | 22.0.0 ≤ v < 22.1.4, 21.0.0 ≤ v < 21.2.22, 20.0.0 ≤ v < 20.3.30, v ≤ 19.2.25 | 22.1.4, 21.2.22, 20.3.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.