Angular SSR Request Vulnerability Allows Attackers to Trick Applications into Sending Unauthorized Requests

A critical SSRF vulnerability (CVE-2026-27739) in Angular Server-Side Rendering allows untrusted Host and X-Forwarded-* headers to manipulate the application base URL and construct unsafe requests, enabling attackers to redirect requests to malicious servers, exfiltrate authorization headers or cookies, and probe internal services. The advisory details attack scenarios, impact, recommended patched Angular versions (21.2.0-rc.1, 21.1.5, 20.3.17, 19.2.21) and mitigation steps such as avoiding req.headers for URL construction and enforcing strict header validation.