@angular/platform-server: SSRF via Hostname Hijacking

🗓️ 19 May 2026 20:29:49Reported by GitHub Advisory DatabaseType

SSRF in Angular platform-server enables hostname hijacking; allowlist validates hosts.

Reporter	Title	Published	Views	Family All 66
ATTACKERKB	CVE-2026-46417	22 Jun 202615:40	–	attackerkb
Circl	CVE-2026-46417	15 May 202617:50	–	circl
CVE	CVE-2026-46417	22 Jun 202615:40	–	cve
Cvelist	CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server	22 Jun 202615:40	–	cvelist
Debian CVE	CVE-2026-46417	22 Jun 202615:40	–	debiancve
EUVD	EUVD-2026-38294	22 Jun 202615:40	–	euvd
NVD	CVE-2026-46417	22 Jun 202618:16	–	nvd
OSV	CLSA-2026-1774570937 TuxCare security update for minimatch (6 CVEs)	4 Aug 202614:52	–	osv
OSV	CLSA-2026-1774657371 TuxCare security update for jsonpath-plus (23 CVEs)	4 Aug 202614:52	–	osv
OSV	CLSA-2026-1781052756 TuxCare security update for @angular (1 CVE)	4 Aug 202614:52	–	osv

Vulners

Node

angular platform-serverRange19.0.0-next.0–19.2.22npm

angular platform-serverRange20.0.0-next.0–20.3.21npm

angular platform-serverRange21.0.0-next.0–21.2.13npm

angular platform-serverRange22.0.0-next.0–22.0.0-next.12npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v
github	www.github.com/angular/angular/pull/68570
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46417
access	www.access.redhat.com/security/cve/CVE-2026-46417
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46417.json
github	www.github.com/advisories/GHSA-rfh7-fxqc-q52v

15 Jul 2026 22:04Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1

CVSS 48.8

EPSS0.00221

SSVC