p PatchFirst

PatchFirst · Latest vulnerabilities

@angular/platform-server vulnerabilities

Vulnerabilities published for @angular/platform-server in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 12

  1. CVE-2026-111754

    Not ratedFix available

    @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

    An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization. When a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.st

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.33
    • Update to 21.2.25
    • Update to 22.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-101895

    High · CVSS 8.7EPSS 0.72%Fix available

    Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.31
    • Update to 21.2.23
    • Update to 22.1.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-88060

    High · CVSS 8.6EPSS 0.36%Fix available

    Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable withou

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.30
    • Update to 21.2.22
    • Update to 22.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-88058

    High · CVSS 8.6EPSS 0.28%Fix available

    Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be aut

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.30
    • Update to 21.2.22
    • Update to 22.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-88056

    High · CVSS 8.6EPSS 0.54%Fix available

    Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that a

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.30
    • Update to 21.2.22
    • Update to 22.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-69149

    High · CVSS 8.6EPSS 0.42%Fix available

    Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 20.3.27
    • Update to 21.2.19
    • Update to 22.0.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-46417

    High · CVSS 8.8EPSS 0.36%Fix available

    Angular: SSRF via Hostname Hijacking in @angular/platform-server

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpCl

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 19.2.22
    • Update to 20.3.21
    • Update to 21.2.13
    • Update to 22.0.0-next.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-50168

    High · CVSS 8.8EPSS 0.24%Fix available

    Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-50556

    High · CVSS 8.6EPSS 0.41%Fix available

    Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements. When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 19.2.25
    • Update to 20.3.24
    • Update to 21.2.16
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-50555

    High · CVSS 8.6EPSS 0.27%Fix available

    Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code un

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 19.2.25
    • Update to 20.3.24
    • Update to 21.2.16
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-41423

    High · CVSS 8.7EPSS 0.48%Fix available

    Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 19.2.21
    • Update to 20.3.19
    • Update to 21.2.9
    • Update to 22.0.0-next.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2025-59052

    High · CVSS 7.1EPSS 0.36%Fix available

    Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response heade

    @angular/platform-server @angular/platform-server @angular/platform-server @angular/platform-serverNode.js
    • Update to 18.2.14
    • Update to 19.2.15
    • Update to 20.3.0
    • Update to 21.0.0-next.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →