CVE-2026-88056

CVE-2026-88056 is a server-side request forgery (SSRF) flaw in Angular's server-side rendering package, @angular/platform-server, caused by URL utilities that strip Unicode whitespace after security validation has already run. When an SSR application validates a user-supplied resource URL using WHATWG URL parsing and then forwards it via HttpClient, the resolveUrl and parseUrl helpers call String.prototype.trim(), which removes leading Unicode whitespace such as U+00A0 or U+FEFF that the WHATWG parser does not treat as whitespace — so a URL that validated as a same-origin relative path is silently converted into a protocol-relative URL pointing at an attacker-controlled origin. Because the trimmed URL is still treated as approved, relativeUrlsTransformerInterceptorFn dispatches the request cross-origin, and if the application attaches sensitive server-side credentials such as Authorization headers to approved requests, the attacker receives those requests and captures the credentials. Only Angular SSR deployments running @angular/platform-server prior to 20.3.30, 21.2.22, and 22.1.4 — specifically those that validate user-controlled URLs and attach credentials to the resulting requests — are affected; purely client-side Angular applications are not. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this analysis.

What to do: Upgrade @angular/platform-server to 20.3.30, 21.2.22, or 22.1.4, matching the major Angular version in use. As interim mitigations, avoid dispatching user-controlled URLs through HttpClient on the server, strip or reject leading non-ASCII Unicode whitespace (U+00A0, U+FEFF) before validation, or re-verify the origin after Angular's own URL processing. Audit SSR code paths that attach Authorization headers or other credentials to validated requests, since those configurations are the ones that turn the SSRF into credential disclosure.