angular angular-cli up to 19.2.20/20.3.16/21.1.4 Relative URL server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in angular angular-cli up to 19.2.20/20.3.16/21.1.4. This affects an unknown function of the component Relative URL Handler. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-27739. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in angular angular-cli up to 19.2.20/20.3.16/21.1.4 and classified as critical. Affected by this issue is an unknown code block of the component Relative URL Handler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the destination domain. Specifically, the framework didn't have checks for the host domain, path and character sanitization, and port validation. This vulnerability manifests in two primary ways: implicit relative URL resolution and explicit manual construction. When successfully exploited, this vulnerability allows for arbitrary internal request steering. This can lead to credential exfiltration, internal network probing, and a confidentiality breach. In order to be vulnerable, the victim application must use Angular SSR (Server-Side Rendering), the application must perform `HttpClient` requests using relative URLs OR manually construct URLs using the unvalidated `Host` / `X-Forwarded-*` headers using the `REQUEST` object, the application server must be reachable by an attacker who can influence these headers without strict validation from a front-facing proxy, and the infrastructure (Cloud, CDN, or Load Balancer) must not sanitize or validate incoming headers. Versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 contain a patch. Some workarounds are available. Avoid using `req.headers` for URL construction. Instead, use trusted variables for base API paths. Those who cannot upgrade immediately should implement a middleware in their `server.ts` to enforce numeric ports and validated hostnames.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-27739 since 02/23/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 19.2.21, 20.3.17, 21.1.5 or 21.2.0-rc.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0534). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Angular

Productinfo

Type

• JavaScript Library

Vendor

• angular

Name

• angular-cli

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 19.2.6
• 19.2.7
• 19.2.8
• 19.2.9
• 19.2.10
• 19.2.11
• 19.2.12
• 19.2.13
• 19.2.14
• 19.2.15
• 19.2.16
• 19.2.17
• 19.2.18
• 19.2.19
• 19.2.20
• 20.3.0
• 20.3.1
• 20.3.2
• 20.3.3
• 20.3.4
• 20.3.5
• 20.3.6
• 20.3.7
• 20.3.8
• 20.3.9
• 20.3.10
• 20.3.11
• 20.3.12
• 20.3.13
• 20.3.14
• 20.3.15
• 20.3.16
• 21.1.0
• 21.1.1
• 21.1.2
• 21.1.3
• 21.1.4

Website

• Product: https://github.com/angular/angular-cli/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion