Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

🗓️ 10 Sep 2026 20:19:43Reported by GitHub Advisory DatabaseType

SSRF and credential leak in Angular SSR via Unicode whitespace bypassing same-origin checks.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-88056	10 Sep 202621:10	–	circl
CVE	CVE-2026-88056	10 Sep 202618:42	–	cve
Cvelist	CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR	10 Sep 202618:42	–	cvelist
Debian CVE	CVE-2026-88056	10 Sep 202618:42	–	debiancve
EUVD	EUVD-2026-75675	10 Sep 202618:42	–	euvd
NVD	CVE-2026-88056	10 Sep 202619:17	–	nvd
OSV	DEBIAN-CVE-2026-88056	10 Sep 202619:17	–	osv
OSV	GHSA-F6MR-PJWC-34M4 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR	10 Sep 202620:19	–	osv
OSV	UBUNTU-CVE-2026-88056	11 Sep 202600:00	–	osv
Positive Technologies	PT-2026-89560	10 Sep 202600:00	–	ptsecurity

Vulners

Node

angular platform-serverRange20.0.0–20.3.30npm

angular platform-serverRange21.0.0–21.2.22npm

angular platform-serverRange22.0.0–22.1.4npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
github	www.github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
github	www.github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
github	www.github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
github	www.github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599
github	www.github.com/angular/angular/releases/tag/v20.3.30
github	www.github.com/angular/angular/releases/tag/v21.2.22
github	www.github.com/angular/angular/releases/tag/v22.1.4
github	www.github.com/advisories/GHSA-f6mr-pjwc-34m4

10 Sep 2026 20:19Current

CVSS 48.6