CVE-2026-41423

Attack Preconditions

• The server has outbound network access.
• The application uses Angular SSR via the affected APIs.
• A pathname is passed as URL to the rendering method (e.g. using req.url).
• The server-side code performs HTTP requests using HttpClient with relative URLs or uses PlatformLocation.hostname to build URLs.

Workarounds

Developers should implement a middleware to sanitize the request URL before it reaches Angular. This involves stripping or normalizing leading slashes:

app.use((req, res, next) => {
  // Sanitize the URL to ensure it starts with a single forward slash
  if (req.url.startsWith('//') || req.url.startsWith('/\\') || req.url.startsWith('\\')) {
     req.url = '/' + req.url.replace(/^[/\\]+/, '');
  }
  next();
});

References

• Fix

A Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR).

When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions.

Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.

Affected APIs:

• renderModule
• renderApplication
• CommonEngine (from @angular/ssr)

Non-Affected APIs:

• AngularAppEngine (from @angular/ssr)
• AngularNodeAppEngine (from @angular/ssr)

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Kodem intelligence

• 22.0.0-next.8
• 21.2.9
• 20.3.19
• 19.2.21

1. What is CVE-2026-41423? CVE-2026-41423 is a high-severity server-side request forgery (SSRF) vulnerability in @angular/platform-server (npm), affecting versions >= 22.0.0-next.0, < 22.0.0-next.8. It is fixed in 22.0.0-next.8, 21.2.9, 20.3.19, 19.2.21. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. Which versions of @angular/platform-server are affected by CVE-2026-41423? @angular/platform-server (npm) versions >= 22.0.0-next.0, < 22.0.0-next.8 is affected.
3. Is there a fix for CVE-2026-41423? Yes. CVE-2026-41423 is fixed in 22.0.0-next.8, 21.2.9, 20.3.19, 19.2.21. Upgrade to this version or later.
4. Is CVE-2026-41423 exploitable, and should I be worried? Whether CVE-2026-41423 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-41423 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-41423?
   • Upgrade @angular/platform-server to 22.0.0-next.8 or later
   • Upgrade @angular/platform-server to 21.2.9 or later
   • Upgrade @angular/platform-server to 20.3.19 or later
   • Upgrade @angular/platform-server to 19.2.21 or later