Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-88056 · Microsoft / collected KEV context

EUVD-2026-75675

GHSA-f6mr-pjwc-34m4

cve-program · CVE-2026-88056

• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4

euvd · EUVD-2026-75675

• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4

nvd · CVE-2026-88056

• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4
• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4

osv · GHSA-f6mr-pjwc-34m4

• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
• https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599
• https://github.com/angular/angular
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4

No related operational record is retained in the current change model.