CVE-2026-41423

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.

• CWE-918

• https://github.com/angular/angular/commit/ede7c58a2aa13fdccc8f0b67ce93ba1c11749412Patch
• https://github.com/angular/angular/pull/68194Issue Tracking
• https://github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973Mitigation, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41417Netty allows request-line validation to be bypassed when a `…5.3
• CVE-2026-414184ga Boards is a boards system for realtime project managemen…5.3
• CVE-2026-414194ga Boards is a boards system for realtime project managemen…7.6
• CVE-2026-4142The Sentence To SEO (keywords, description and tags) plugin …4.4
• CVE-2026-41421SiYuan is an open-source personal knowledge management syste…8.8
• CVE-2026-41422Daptin is a GraphQL/JSON-API headless CMS. Prior to version …8.3
• CVE-2026-41425Authlib is a Python library which builds OAuth and OpenID Co…5.4
• CVE-2026-41426pretalx is a conference planning tool. Prior to 2026.1.0, an…6.1
• CVE-2026-41427Better Auth is an authentication and authorization library f…6.5
• CVE-2026-41428Budibase is an open-source low-code platform. Prior to 3.35.…9.1
• CVE-2026-41429arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.8
• CVE-2026-4143The Neos Connector for Fakturama plugin for WordPress is vul…4.3