CVE-2026-88056
Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in Angular SSR

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88056
EUVD
EUVD-2026-75675

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
angular platform-server 20.3.30
angular platform-server 21.2.22
angular platform-server 22.1.4
angular platform-server 20.0.0
angular platform-server to 20.3.30 (exc)
angular platform-server to 21.2.22 (exc)
angular platform-server to 22.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88056 is a Server-Side Request Forgery (SSRF) vulnerability in Angular's Server-Side Rendering (SSR) that allows attackers to bypass same-origin checks and send HTTP requests to attacker-controlled origins. It occurs because Angular's URL resolution trims Unicode whitespace (like U+00A0 or U+FEFF) after WHATWG URL parsing, converting a relative path into a protocol-relative URL. This causes sensitive credentials like Authorization headers to be sent to unauthorized origins.

Detection Guidance

To detect this vulnerability, inspect Angular SSR applications using versions 20.0.0 to 20.3.29, 21.0.0 to 21.2.21, or 22.0.0 to 22.1.3. Check for user-controlled input influencing HttpClient URLs with Unicode whitespace like U+00A0 or U+FEFF. Review server logs for unexpected cross-origin requests or credential disclosures.

Impact Analysis

This vulnerability can lead to SSRF attacks, allowing attackers to make unauthorized requests from your server to internal or external systems. It may also cause credential disclosure if your application attaches sensitive headers like Authorization to requests. Attackers could exploit this to exfiltrate data or interact with internal services.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or exfiltration, which may conflict with GDPR's data protection principles or HIPAA's security rules for safeguarding sensitive information. Organizations using affected Angular versions may face compliance risks due to potential credential leaks and unauthorized server interactions.

Mitigation Strategies

Upgrade to patched versions: 20.3.30, 21.2.22, or 22.1.4. As a workaround, validate and sanitize input URLs to block leading Unicode whitespace before origin checks. Avoid relying solely on WHATWG URL parsing for authorization if input may be processed by utilities that normalize whitespace differently.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart