Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

🗓️ 16 Apr 2026 22:36:01Reported by GitHub Advisory DatabaseType

SSRF in Angular platform-server due to improper URL handling during SSR, making attacker origin appear local.

Reporter	Title	Published	Views	Family All 13
CNNVD	Angular 代码问题漏洞	8 May 202600:00	–	cnnvd
CVE	CVE-2026-41423	8 May 202613:06	–	cve
Cvelist	CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server	8 May 202613:06	–	cvelist
Debian CVE	CVE-2026-41423	8 May 202613:06	–	debiancve
EUVD	EUVD-2026-28552	8 May 202613:06	–	euvd
NVD	CVE-2026-41423	8 May 202614:16	–	nvd
OSV	DEBIAN-CVE-2026-41423	8 May 202614:16	–	osv
OSV	GHSA-45Q2-GJVG-7973 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server	16 Apr 202622:36	–	osv
Positive Technologies	PT-2026-37114	16 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-41423	5 Jun 202619:20	–	redhatcve

Vulners

Node

angular platform-serverRange19.0.0-next.0–19.2.21npm

angular platform-serverRange20.0.0-next.0–20.3.19npm

angular platform-serverRange21.0.0-next.0–21.2.9npm

angular platform-serverRange22.0.0-next.0–22.0.0-next.8npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973
github	www.github.com/angular/angular/pull/68194
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41423
github	www.github.com/angular/angular/commit/ede7c58a2aa13fdccc8f0b67ce93ba1c11749412
github	www.github.com/advisories/GHSA-45q2-gjvg-7973

12 May 2026 13:31Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

CVSS 48.7

EPSS0.00256

SSVC