Server-Side Rendering Vulnerability in Angular Development Platform
CVE-2026-88056
8.6HIGH
What is CVE-2026-88056?
The Angular development platform has a vulnerability in its Server-Side Rendering (SSR) that processes user-controlled URLs via HttpClient. Prior to specific version updates, an issue existed where Unicode whitespace was improperly handled, potentially allowing attackers to manipulate request URLs once application code validated them. This vulnerability can lead to SSRF attacks and disclosure of sensitive information, such as server-side credentials, if the application attaches such sensitive data to requests. It is crucial for users to update to the latest versions (20.3.30, 21.2.22, or 22.1.4) to mitigate this risk.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.30 < 20.0.0, 20.3.30
angular >= 21.0.0, < 21.2.22 < 21.0.0, 21.2.22