angular-cli up to 19.2.17/20.3.5/21.0.0-next.7 createRequestUrl server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in angular-cli up to 19.2.17/20.3.5/21.0.0-next.7. This impacts the function createRequestUrl. Executing a manipulation can lead to server-side request forgery. This vulnerability is handled as CVE-2025-62427. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in angular-cli up to 19.2.17/20.3.5/21.0.0-next.7. It has been declared as critical. This vulnerability affects the function createRequestUrl. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Angular CLI is a command-line interface tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-62427 since 10/13/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 19.2.18, 20.3.6 or 21.0.0-next.8 eliminates this vulnerability. Applying the patch 5271547c80662de10cb3bcb648779a83f6efedfb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-34823). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• angular-cli

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 19.2.6
• 19.2.7
• 19.2.8
• 19.2.9
• 19.2.10
• 19.2.11
• 19.2.12
• 19.2.13
• 19.2.14
• 19.2.15
• 19.2.16
• 19.2.17
• 20.3.0
• 20.3.1
• 20.3.2
• 20.3.3
• 20.3.4
• 20.3.5
• 21.0.0-next.0
• 21.0.0-next.1
• 21.0.0-next.2
• 21.0.0-next.3
• 21.0.0-next.4
• 21.0.0-next.5
• 21.0.0-next.6
• 21.0.0-next.7

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion