CVE-2026-88056 in Angular
Summary
by MITRE • 09/10/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within Angular's Server-Side Rendering (SSR) implementation represents a critical flaw in how the framework processes user-controlled URLs during server-side execution. Specifically, this issue affects versions prior to 20.3.30, 21.2.22, and 22.1.4 of @angular/platform-server. The core mechanism involves the resolveUrl and parseUrl utilities which are responsible for normalizing URL inputs before they are dispatched via HttpClient. While application code may perform initial validation using WHATWG URL parsing to ensure a resource is within an approved same-origin scope, this check occurs prior to further processing by Angular's internal utility functions. This sequence creates a window of opportunity where the structural integrity of the URL can be manipulated after security checks have been satisfied but before the actual network request is initiated.
The technical root cause lies in the behavior of String.prototype.trim() as implemented within these utilities. The trim method removes leading and trailing whitespace characters from strings, including specific Unicode whitespace such as U+00A0 (Non-Breaking Space) or U+FEFF (Byte Order Mark). When an attacker provides a relative path that begins with one of these invisible Unicode characters, the initial same-origin check perceives the URL as valid because it does not recognize the leading character as part of the protocol-relative syntax. However, once the trim function executes, it strips away this leading whitespace, effectively revealing or converting the remainder of the string into a protocol-relative URL (e.g., //evil.com/path). This transformation allows an attacker to bypass same-origin restrictions by disguising their malicious target within what appears to be a benign relative path during validation.
The operational impact of this vulnerability is severe, particularly for applications that utilize SSR and attach sensitive credentials such as Authorization headers or cookies to outgoing requests based on domain trust policies. Because the request is ultimately dispatched with an attacker-controlled origin after the trim operation, it results in Server-Side Request Forgery (SSRF). This allows attackers to make authenticated requests from the server's perspective to arbitrary external domains. Consequently, sensitive authentication tokens and session data can be exfiltrated to malicious servers under the guise of legitimate application traffic. Furthermore, this SSRF capability could potentially be leveraged for internal network scanning or accessing other backend services that trust the primary web server, thereby expanding the attack surface beyond simple credential theft.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) due to its ability to force the server to make requests to unintended destinations. It also relates to CWE-602 Client-Side Injection of Script and CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves improper handling of special Unicode characters that alter URL parsing behavior. In terms of MITRE ATT&CK tactics, this flaw facilitates the T1583 Acquire Infrastructure stage if used for reconnaissance or data exfiltration via C2 channels, and potentially impacts confidentiality through credential harvesting.
Mitigation strategies primarily involve upgrading to patched versions of Angular where 20.3.30, 21.2.22, and 22.1.4 are the minimum safe releases. These updates correct the logic within resolveUrl and parseUrl to ensure that URL normalization occurs in a manner that preserves security boundaries or validates the final resolved origin after trimming operations. For applications unable to upgrade immediately, developers should implement strict input validation at the application layer rather than relying solely on framework-level checks. This includes explicitly rejecting URLs containing non-standard whitespace characters before they reach Angular's SSR pipeline and ensuring that HttpClient interceptors do not blindly trust URL objects derived from user inputs without re-validating their origin after any string manipulation. Additionally, configuring Content Security Policy headers to restrict outbound connections can provide a secondary layer of defense against successful exploitation attempts.