Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.

According to its self-reported version number, Angular is prior to 19.0.0, 19.x prior to 19.2.21, 20.x prior to 20.3.19 or 21.x prior to 21.2.9. It is, therefore, affected by a Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server. Protocol-relative and backslash request URLs (such as /\evil.com/) cause the SSR engine to treat the attacker domain as the current origin, redirecting relative HttpClient requests to an attacker-controlled server. (CVE-2026-41423)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8,     a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper     handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET     /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular's rendering     functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the     internal state of the application is hijacked to believe the current origin is evil.com. This     misinterpretation tricks the application into treating the attacker's domain as the local origin.
    Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to     the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has     been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8. (CVE-2026-41423)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8,
    a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper
    handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET
    /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering
    functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the
    internal state of the application is hijacked to believe the current origin is evil.com. This
    misinterpretation tricks the application into treating the attacker’s domain as the local origin.
    Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to
    the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has
    been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8. (CVE-2026-41423)

ID	Name	Product	Family	Type	Severity
115616	Angular < 19.2.21 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115615	Angular 19.x < 19.2.21 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115614	Angular 20.x < 20.3.19 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115613	Angular 21.x < 21.2.9 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
322293	Linux Distros Unpatched Vulnerability : CVE-2026-41423	Nessus	Misc.	Local	high
440924	SCA: security update for @angular/platform-server (GHSA-45q2-gjvg-7973)	Tenable Cloud Security	SCA Checks	Local	high
440924	SCA: security update for @angular/platform-server (GHSA-45q2-gjvg-7973)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-41423

high

Tenable Plugins

high

high

high

high

high

high

high