GHSA-rfh7-fxqc-q52v
NoneCVSS
—
EPSS
—
Published
May 19, 2026
CISA due date
—
The record
@angular/platform-server: SSRF via Hostname Hijacking
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/platform-server | 0 | No fix |
| npm | @angular/platform-server | 19.0.0-next.0 | 19.2.22 |
| npm | @angular/platform-server | 20.0.0-next.0 | 20.3.21 |
| npm | @angular/platform-server | 21.0.0-next.0 | 21.2.13 |
| npm | @angular/platform-server | 22.0.0-next.0 | 22.0.0-next.12 |
Related vulnerabilities
- CVE-2026-46417 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50556 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-50555 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-50168 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- GHSA-gxx4-3xcv-f8qx @angular/platform-server: Missing `` Raw-Text Serialization Escaping leads to Cross-Site… Also affects @angular/platform-server
- GHSA-hqr9-c56f-3x7f @angular/platform-server: Improper Neutralization of Input During Web Page Generation… Also affects @angular/platform-server
- GHSA-xrxm-cp7j-8xf6 @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass Also affects @angular/platform-server
- CVE-2026-41423 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server