Loading story…
Nuxt disclosed CVE-2026-53722, a reflected DOM-based cross-site scripting flaw in the <NuxtLink> component affecting versions before 3.21.7 and 4.4.7. The bug allowed attacker-controlled values passed into to or href to be rendered into anchor tags without proper URI scheme sanitization, enabling javascript: or data: payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into <NuxtLink>, and Nuxt fixed it by introducing sanitizeExternalHref to block unsafe protocols and abort navigation.
Angular also disclosed an SSRF vulnerability in @angular/platform-server under GHSA-rfh7-fxqc-q52v, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative HttpClient requests or PlatformLocation.hostname lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22; no fix was listed for the 18.x line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Angular addressed CVE-2026-50168, a high-severity SSRF flaw in @angular/platform-server caused by a parser differential between Node's WHATWG URL parser and Domino's lenient parser. The issue lets attackers bypass host allowlist checks with malformed URLs and was fixed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
A reflected DOM-based cross-site scripting vulnerability affecting Nuxt's <NuxtLink> component was reported as CVE-2026-53722. The issue affects versions prior to 3.21.7 and 4.4.7 and was addressed by adding sanitizeExternalHref to block unsafe URI schemes.
Angular published advisory GHSA-rfh7-fxqc-q52v for a server-side request forgery vulnerability in @angular/platform-server caused by hostname hijacking during server-side rendering. The advisory lists patched versions 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, and notes no patch for the 18.x line.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Angular disclosed a **server-side request forgery (SSRF)** issue in `@angular/platform-server` that affects applications using Server-Side Rendering. The flaw, tracked as `CVE-2026-41423`, stems from improper handling of protocol-relative and backslash-based URLs passed from server engines such as Express into Angular rendering functions. A crafted request can cause Angular to treat an attacker-controlled domain as the application's origin, allowing relative `HttpClient` requests and `PlatformLocation.hostname` references to resolve to external infrastructure. The issue can expose internal services, including private APIs and cloud metadata endpoints, and related advisory material also links the bug family to **header injection** risks in Angular SSR deployments. Angular fixed the vulnerability in versions `19.2.21`, `20.3.19`, `21.2.9`, and `22.0.0-next.8`, leaving earlier releases vulnerable where SSR is enabled and untrusted request paths can influence rendering context.
Jun 29, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026