High-Severity SSRF Flaw Uncovered in Angular’s Server-Side Rendering

A high-severity SSRF vulnerability (CVSS 8.7) in the @angular/platform-server package allows attackers to hijack the application’s internal origin during server-side rendering by exploiting URL normalization (e.g., backslashes or protocol-relative URLs), which can redirect relative HTTP requests to attacker-controlled domains; affected APIs include renderModule, renderApplication, and the Common Engine. The Angular team has released patches across multiple version lines and provides a middleware-based URL-sanitization workaround for teams that cannot immediately upgrade.