Server-Side Request Forgery Vulnerability in Angular CLI Component
CVE-2025-62427
What is CVE-2025-62427?
The Angular CLI is impacted by a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of the @angular/ssr package. This issue arises when incoming request paths formatted with double forward slashes (//) or backslashes () are processed, causing the URL constructor to treat them as schema-relative URLs. As a result, attackers can manipulate the URL resolution to point to their own external domains. This misconfiguration may allow unauthorized access to resources and result in the server communicating with potentially harmful external endpoints during the server-side rendering process. The flaw has been addressed in versions 19.2.18, 20.3.6, and 21.0.0-next.8.
Affected Version(s)
angular-cli >=19.0.0-next.0, < 19.2.18 < 19.0.0-next.0, 19.2.18
angular-cli >=20.0.0-next.0, < 20.3.6 < 20.0.0-next.0, 20.3.6
angular-cli >=21.0.0-next.0, < 21.0.0-next.8 < 21.0.0-next.0, 21.0.0-next.8