Angular SSR Flaw Enables Unauthorized Server-Side Requests in Web Apps

A critical vulnerability has been identified in Angular Server-Side Rendering (SSR), potentially enabling Server-Side Request Forgery (SSRF) and Header Injection attacks. This vulnerability, tracked as CVE-2026-27739, allows unauthorized server-side requests in web applications, which may result in credential theft, internal network probing, and data exposure.

The flaw affects multiple versions of @angular/ssr , @nguniversal/common , and @nguniversal/express-engine .

The vulnerability originates from Angular's internal URL reconstruction logic, which processes user-controlled HTTP headers without adequate verification. The framework relies on Host and X-Forwarded-* headers to determine the application's base origin, but it fails to verify the destination domain.

Host Domain: The Host and X-Forwarded-Host headers are not verified against trusted origins, allowing potential redirection to malicious domains. Path & Character Sanitization: The X-Forwarded-Host header does not check path segments or special characters, enabling manipulation of base paths for relative URLs. Port Validation: The X-Forwarded-Port header is not strictly validated as numeric, potentially leading to malformed URI construction and injection attacks.

On exploitation, this vulnerability allows attackers to redirect internal requests to arbitrary destinations. This is primarily achieved through Angular's HttpClient resolving relative URLs against the unvalidated base origin or when developers manually construct URLs using unsanitized headers.

Credential Exfiltration: Unauthorized access to sensitive data, such as Authorization headers or session cookies. Internal Network Probing: Access to internal services, databases, or cloud metadata endpoints. Confidentiality Breach: Exposure of sensitive information processed within the server-side environment.

The target application uses Angular SSR. Utilization of HttpClient for relative URLs or manual URL construction using unvalidated headers. Attacker's ability to manipulate headers directly without strict validation. Lack of upstream validation from infrastructure like cloud providers, CDNs, or load balancers.

Developers should immediately update @angular/ssr packages to the following patched versions: 21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21.

If immediate upgrade is not feasible, consider the following workarounds:

Use Absolute URLs: Avoid using req.headers for URL construction. Instead, rely on trusted, hardcoded variables for base API paths. Implement Strict Header Validation: Enforce numeric ports and validated hostnames in your server.ts file, ensuring only approved domains can interact with the server.

These steps help protect Angular applications from unauthorized server-side requests and maintain internal network security.

Based on reporting by GBHackers.