{"id":"GHSA-q63q-pgmf-mxhr","revision":"56b3e73dbd6448eca74ac08f841cbb97","records":[{"revision":"56b3e73dbd6448eca74ac08f841cbb97","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q63q-pgmf-mxhr","aliases":["CVE-2025-62427"],"title":"Angular SSR has a Server-Side Request Forgery (SSRF) flaw","description":"### Impact\nThe vulnerability is a **Server-Side Request Forgery (SSRF)** flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (`@angular/ssr`).\n\nThe function `createRequestUrl` uses the native `URL` constructor. When an incoming request path (e.g., `originalUrl` or `url`) begins with a **double forward slash (`//`) or backslash (`\\\\`)**, the `URL` constructor treats it as a **schema-relative URL**. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname.\n\nThis allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via `DOCUMENT` or `PlatformLocation` tokens) to this attacker-controlled domain. Any subsequent **relative HTTP requests** made during the SSR process (e.g., using `HttpClient.get('assets/data.json')`) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint.\n\n#### Exploit Scenario\nA request to `http://localhost:4200//attacker-domain.com/some-page` causes Angular to believe the host is attacker-domain.com. A relative request to api/data then becomes a server-side request to `http://attacker-domain.com/api/data`.\n\n### Patches\n\n- `@angular/ssr` 19.2.18\n- `@angular/ssr` 20.3.6\n- `@angular/ssr` 21.0.0-next.8\n\n## Mitigation\n\nThe application's internal location must be robustly determined from the incoming request. The fix requires sanitizing or validating the request path to prevent it from being interpreted as a schema-relative URL (i.e., ensuring it does not start with `//`).\n\n#### Server-Side Middleware\nIf you can't upgrade to a patched version, implement a **middleware** on the Node.js/Express server that hosts the Angular SSR application to explicitly reject or sanitize requests where the path begins with a double slash (`//`).\n\n**Example (Express/Node.js):**\n\n```ts\n// Place this middleware before the Angular SSR handler\napp.use((req, res, next) => {\n  if (req.originalUrl?.startsWith('//')) {\n    // Sanitize by forcing a single slash\n    req.originalUrl = req.originalUrl.replace(/^\\/\\/+/, '/');\n    req.url = req.url.replace(/^\\/\\/+/, '/');\n  }\n  next();\n});\n```\n\n### References\n\n- Report: https://github.com/angular/angular-cli/issues/31464\n- Fix:  https://github.com/angular/angular-cli/pull/31474","state":0,"publishedAt":"2025-10-16T21:28:19+00:00","modifiedAt":"2025-10-16T21:55:01+00:00","affected":[{"ecosystem":"npm","name":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.0.0-next.0"},{"kind":"fixed","version":"19.2.18"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"20.0.0-next.0"},{"kind":"fixed","version":"20.3.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@angular/ssr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"21.0.0-next.0"},{"kind":"fixed","version":"21.0.0-next.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr","https://nvd.nist.gov/vuln/detail/CVE-2025-62427","https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb","https://github.com/angular/angular-cli"],"sourceUrl":"https://github.com/advisories/GHSA-q63q-pgmf-mxhr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q63q-pgmf-mxhr","identifiers":["GHSA-q63q-pgmf-mxhr","CVE-2025-62427"]},"retained":false,"historicalAffected":[]}],"coverage":[]}