{"id":"GHSA-q63q-pgmf-mxhr","summary":"Angular SSR has a Server-Side Request Forgery (SSRF) flaw","details":"### Impact\nThe vulnerability is a **Server-Side Request Forgery (SSRF)** flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (`@angular/ssr`).\n\nThe function `createRequestUrl` uses the native `URL` constructor. When an incoming request path (e.g., `originalUrl` or `url`) begins with a **double forward slash (`//`) or backslash (`\\\\`)**, the `URL` constructor treats it as a **schema-relative URL**. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname.\n\nThis allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via `DOCUMENT` or `PlatformLocation` tokens) to this attacker-controlled domain. Any subsequent **relative HTTP requests** made during the SSR process (e.g., using `HttpClient.get('assets/data.json')`) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint.\n\n#### Exploit Scenario\nA request to `http://localhost:4200//attacker-domain.com/some-page` causes Angular to believe the host is attacker-domain.com. A relative request to api/data then becomes a server-side request to `http://attacker-domain.com/api/data`.\n\n### Patches\n\n- `@angular/ssr` 19.2.18\n- `@angular/ssr` 20.3.6\n- `@angular/ssr` 21.0.0-next.8\n\n## Mitigation\n\nThe application's internal location must be robustly determined from the incoming request. The fix requires sanitizing or validating the request path to prevent it from being interpreted as a schema-relative URL (i.e., ensuring it does not start with `//`).\n\n#### Server-Side Middleware\nIf you can't upgrade to a patched version, implement a **middleware** on the Node.js/Express server that hosts the Angular SSR application to explicitly reject or sanitize requests where the path begins with a double slash (`//`).\n\n**Example (Express/Node.js):**\n\n```ts\n// Place this middleware before the Angular SSR handler\napp.use((req, res, next) =\u003e {\n  if (req.originalUrl?.startsWith('//')) {\n    // Sanitize by forcing a single slash\n    req.originalUrl = req.originalUrl.replace(/^\\/\\/+/, '/');\n    req.url = req.url.replace(/^\\/\\/+/, '/');\n  }\n  next();\n});\n```\n\n### References\n\n- Report: https://github.com/angular/angular-cli/issues/31464\n- Fix:  https://github.com/angular/angular-cli/pull/31474","aliases":["CVE-2025-62427"],"modified":"2025-10-16T21:55:01Z","published":"2025-10-16T21:28:19Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-10-16T21:28:19Z","nvd_published_at":"2025-10-16T19:15:35Z","cwe_ids":["CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62427"},{"type":"WEB","url":"https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb"},{"type":"PACKAGE","url":"https://github.com/angular/angular-cli"}],"affected":[{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0-next.0"},{"fixed":"19.2.18"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q63q-pgmf-mxhr/GHSA-q63q-pgmf-mxhr.json"}},{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0-next.0"},{"fixed":"20.3.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q63q-pgmf-mxhr/GHSA-q63q-pgmf-mxhr.json"}},{"package":{"name":"@angular/ssr","ecosystem":"npm","purl":"pkg:npm/%40angular/ssr"},"ranges":[{"type":"SEMVER","events":[{"introduced":"21.0.0-next.0"},{"fixed":"21.0.0-next.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q63q-pgmf-mxhr/GHSA-q63q-pgmf-mxhr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}