{"id":"EUVD-2026-75675","enisaUuid":"81d91a67-7103-36d1-ba20-baae41083567","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","datePublished":"Sep 10, 2026, 6:42:34 PM","dateUpdated":"Sep 15, 2026, 2:56:52 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4\nhttps://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c\nhttps://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132\nhttps://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","aliases":"CVE-2026-88056\nGHSA-f6mr-pjwc-34m4\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"478f6385-e363-3a4f-9a3f-93d5e1ed41f6","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.4"},{"id":"715b16ac-30dc-360f-9522-19b7189e8f36","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.22"},{"id":"99e586cf-ed99-33b5-8a0c-8b0cdb23716d","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"bfee6040-5a2d-3a39-8556-e82fe6c2e9b8","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.30"}],"enisaIdVendor":[{"id":"b1c48d56-2aea-33bd-8eb0-dd0605978f46","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"53622022-acaa-33c0-a498-394fbdb9ffff","vulnerability":{"id":"CVE-2026-88056","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","datePublished":"Sep 10, 2026, 6:42:34 PM","dateUpdated":"Sep 15, 2026, 2:56:52 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4\nhttps://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c\nhttps://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132\nhttps://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","enisa_id":"EUVD-2026-75675\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Nov 3, 2026, 7:14:08 AM","vulnerabilityProduct":[{"id":"25ae0fa7-bd77-37c5-9a33-bdf7b066e268","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.4"},{"id":"5b77e755-37c1-3ee2-8ce1-880de3893411","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.30"},{"id":"6b90bb45-d677-3d10-83f0-81f879834e66","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.22"},{"id":"e38e2c41-beef-3cab-8169-dcd9d73d7125","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"}],"vulnerabilityVendor":[{"id":"eccf87b8-55cc-30c9-b220-609f5a62ecba","vendor":{"name":"angular"}}]}},{"id":"8808e413-e2ed-3a3c-a2df-c500fe59e762","vulnerability":{"id":"GHSA-f6mr-pjwc-34m4","description":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","datePublished":"Sep 10, 2026, 8:19:43 PM","dateUpdated":"Sep 10, 2026, 8:19:43 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4\nhttps://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c\nhttps://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132\nhttps://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970\nhttps://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599\nhttps://github.com/angular/angular\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","enisa_id":"EUVD-2026-75675\n","aliases":"GHSA-f6mr-pjwc-34m4\nCVE-2026-88056\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}