Loading story…
Angular disclosed a server-side request forgery (SSRF) issue in @angular/platform-server that affects applications using Server-Side Rendering. The flaw, tracked as CVE-2026-41423, stems from improper handling of protocol-relative and backslash-based URLs passed from server engines such as Express into Angular rendering functions. A crafted request can cause Angular to treat an attacker-controlled domain as the application's origin, allowing relative HttpClient requests and PlatformLocation.hostname references to resolve to external infrastructure.
The issue can expose internal services, including private APIs and cloud metadata endpoints, and related advisory material also links the bug family to header injection risks in Angular SSR deployments. Angular fixed the vulnerability in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, leaving earlier releases vulnerable where SSR is enabled and untrusted request paths can influence rendering context.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Angular fixed an SSRF flaw in @angular/platform-server caused by improper handling of protocol-relative and backslash URLs in SSR contexts. The issue was patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.
A GitHub security advisory was published for Angular SSR describing SSRF and header injection issues affecting Angular server-side rendering. The advisory is associated with angular/angular-cli.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nuxt disclosed **CVE-2026-53722**, a reflected DOM-based cross-site scripting flaw in the `<NuxtLink>` component affecting versions before **3.21.7** and **4.4.7**. The bug allowed attacker-controlled values passed into `to` or `href` to be rendered into anchor tags without proper URI scheme sanitization, enabling `javascript:` or `data:` payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into `<NuxtLink>`, and Nuxt fixed it by introducing `sanitizeExternalHref` to block unsafe protocols and abort navigation. Angular also disclosed an SSRF vulnerability in `@angular/platform-server` under **GHSA-rfh7-fxqc-q52v**, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative `HttpClient` requests or `PlatformLocation.hostname` lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include **22.0.0-next.12**, **21.2.13**, **20.3.21**, and **19.2.22**; no fix was listed for the **18.x** line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Jun 29, 2026
A high-severity vulnerability in Angular's `@angular/common/http` package allows semantically different `HttpClient` requests to collide on the same `HttpTransferCache` key during Server-Side Rendering and client-side hydration, enabling cross-request response reuse and client-side state poisoning. The flaw, tracked as **CVE-2026-68945**, stems from ambiguous query-parameter serialization in cache-key generation, including cases where repeated parameters are comma-joined or attacker-controlled delimiters such as `&` and `=` produce identical serialized forms. The issue is remotely exploitable without authentication and carries a **CVSS 4.0 score of 8.8**. Angular fixed the bug by replacing custom serialization logic with native `URLSearchParams` sorting and encoding, and released patched versions **20.3.27**, **21.2.19**, and **22.0.2**; versions prior to those releases are affected. Public references include Angular commits, a pull request, and a GitHub security advisory documenting the remediation.
Aug 3, 2026
A high-severity vulnerability, tracked as CVE-2025-66412, has been discovered in the Angular framework, allowing stored cross-site scripting (XSS) attacks through SVG animation, SVG URL, and MathML attributes. The flaw exists in the Angular Template Compiler, where the internal security schema fails to properly classify certain URL-holding attributes as requiring strict URL security, enabling attackers to inject malicious scripts that bypass Angular's built-in sanitization. This vulnerability affects Angular versions prior to 21.0.2, 20.3.15, and 19.2.17, and has been addressed in these subsequent releases. Attackers exploiting this vulnerability can persistently inject malicious JavaScript into web applications built with vulnerable Angular versions, potentially compromising user data and session integrity. Organizations using Angular are strongly advised to update to the fixed versions to mitigate the risk of exploitation. The vulnerability is remotely exploitable and has been rated as high severity, with a CVSS 4.0 score of 8.5, underscoring the urgency for prompt remediation.
Jun 29, 2026