CVE-2026-46417

Fix Information

The vulnerability is mitigated by introducing an Allowlist Mechanism directly into the core rendering APIs.
The renderModule and renderApplication functions now include an allowedHosts configuration option. The rendering engine validates the hostname extracted from the request URL against this list before proceeding. If the hostname does not match an allowed entry, the engine prevents the hostname hijacking, ensuring that HttpClient requests remain restricted to trusted domains.

Workarounds

Developers unable to update immediately should implement strict URL validation in their server entry point (e.g., server.ts). Ensure that req.url is validated against a known list of trusted hostnames or normalized to a relative path before being passed torenderApplication or renderModule.

// Example manual normalization in Express
app.get('*', (req, res, next) => {
  const trustedHost = 'localhost:4000';
  // Ensure the request target matches expectations
  if (req.headers.host !== trustedHost) {
     return res.status(403).send('Forbidden');
  }
  next();
});

A Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points.

When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname.

Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Kodem intelligence

• 22.0.0-next.12
• 21.2.13
• 20.3.21
• 19.2.22

1. What is CVE-2026-46417? CVE-2026-46417 is a high-severity server-side request forgery (SSRF) vulnerability in @angular/platform-server (npm), affecting versions >= 22.0.0-next.0, < 22.0.0-next.12. It is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, 19.2.22. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. Which versions of @angular/platform-server are affected by CVE-2026-46417? @angular/platform-server (npm) versions >= 22.0.0-next.0, < 22.0.0-next.12 is affected.
3. Is there a fix for CVE-2026-46417? Yes. CVE-2026-46417 is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, 19.2.22. Upgrade to this version or later.
4. Is CVE-2026-46417 exploitable, and should I be worried? Whether CVE-2026-46417 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-46417 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-46417?
   • Upgrade @angular/platform-server to 22.0.0-next.12 or later
   • Upgrade @angular/platform-server to 21.2.13 or later
   • Upgrade @angular/platform-server to 20.3.21 or later
   • Upgrade @angular/platform-server to 19.2.22 or later