SSRF Risk in Server-Side Rendering: Patch Your Angular Applications

A critical hostname-hijacking vulnerability in Angular's server-side rendering (@angular/platform-server) can cause SSRF by allowing absolute attacker-controlled URLs to set the runtime hostname, redirecting internal HttpClient requests to malicious domains and potentially exposing cloud metadata or private APIs. The flaw is rated CVSS 8.8; official fixes add an allowedHosts configuration to renderModule/renderApplication and patched versions are provided (e.g., 21.2.13, 20.3.21, 19.2.22, 22.0.0-next.12). Temporary mitigations include normalizing req.url and validating the Host header before rendering.