GHSA-45q2-gjvg-7973
NoneCVSS
—
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/platform-server | 0 | No fix |
| npm | @angular/platform-server | 19.0.0-next.0 | 19.2.21 |
| npm | @angular/platform-server | 20.0.0-next.0 | 20.3.19 |
| npm | @angular/platform-server | 21.0.0-next.0 | 21.2.9 |
| npm | @angular/platform-server | 22.0.0-next.0 | 22.0.0-next.8 |
Related vulnerabilities
- CVE-2026-41423 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50556 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-50555 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-50168 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-46417 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- GHSA-gxx4-3xcv-f8qx @angular/platform-server: Missing `` Raw-Text Serialization Escaping leads to Cross-Site… Also affects @angular/platform-server
- GHSA-hqr9-c56f-3x7f @angular/platform-server: Improper Neutralization of Input During Web Page Generation… Also affects @angular/platform-server
- GHSA-xrxm-cp7j-8xf6 @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass Also affects @angular/platform-server