CVE-2026-27739: Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.5%, percentile 44: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 44% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes @angular/ssr (npm) >= 21.2.0-next.0, < 21.2.0-rc.0, fixed in 21.2.0-rc.1; @angular/ssr (npm) >= 21.0.0-next.0, < 21.1.5, fixed in 21.1.5; @angular/ssr (npm) >= 20.0.0-next.0, < 20.3.17, fixed in 20.3.17; @angular/ssr (npm) < 19.2.21, fixed in 19.2.21. Check your lockfile, including transitive dependencies.

What it is

The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and X-Forwarded- family to determine the application's base origin without any validation of the destination domain. Specifically, the framework didn't have checks for the host domain, path and character sanitization, and port validation. This vulnerability manifests in two primary ways: implicit relative URL resolution and explicit manual construction. When successfully exploited, this vulnerability allows for arbitrary internal request steering. This can lead to credential exfiltration, internal network probing, and a confidentiality breach. In order to be vulnerable, the victim application must use Angular SSR (Server-Side Rendering), the application must perform HttpClient requests using relative URLs OR manually construct URLs using the unvalidated Host / X-Forwarded- headers using the REQUEST object, the application server must be reachable by an attacker who can influence these headers without strict validation from a front-facing proxy, and the infrastructure (Cloud, CDN, or Load Balancer) must not sanitize or validate incoming headers. Versions 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 contain a patch. Some workarounds are available. Avoid using req.headers for URL construction. Instead, use trusted variables for base API paths. Those who cannot upgrade immediately should implement a middleware in their server.ts to enforce numeric ports and validated hostnames.

From the GitHub advisory

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and X-Forwarded- family to determine the application's base origin without any validation of the destination domain.

Specifically, the framework didn't have checks for the following: - Host Domain: The Host and X-Forwarded-Host headers were not checked to belong to a trusted origin. This allows an attacker to redefine the "base" of the application to an arbitrary external domain. - Path & Character Sanitization: The X-Forwarded-Host header was not checked for path segments or special characters, allowing manipulation of the base path for all resolved relative URLs. - Port Validation: The X-Forwarded-Port header was not verified as numeric, leading to malformed URI construction or injection attacks.

This vulnerability manifests in two primary ways:

- Implicit Relative URL Resolution: Angular's HttpClient resolves relative URLs against this unvalidated and potentially malformed base origin. An attacker can "steer" these requests to an external server or internal service. - Explicit Manual Construction: Developers injecting the REQUEST object to manually construct URLs (for fetch or third-party SDKs) directly inherit these unsanitized values. By accessing the Host / X-Forwarded- headers, the application logic may perform requests to attacker-controlled destinations or malformed endpoints.

Impact

Weakness type: CWE-918.

Product: @angular/ssr (npm) · Assigned by: GitHub_M · Published: 2026-02-25

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.53% probability of exploitation activity in the next 30 days; percentile 44.

Timeline

• 2026-02-25 — CVE record published by GitHub_M
• 2026-02-25 — GitHub-reviewed advisory GHSA-x288-3778-4hhx published (critical)
• 2026-02-27 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-x288-3778-4hhx github.com
2. CVE.org record CVE-2026-27739 cve.org
3. NVD entry CVE-2026-27739 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. angular.dev angular.dev
4. developer.mozilla.org developer.mozilla.org

Critical npm advisories · Today’s Security Digest