Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22.

According to its self-reported version number, Angular is prior to 19.0.0, 19.x prior to 19.2.22, 20.x prior to 20.3.21 or 21.x prior to 21.2.13. It is, therefore, affected by a Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server. When an absolute-form URL is passed to the rendering engine, the ServerPlatformLocation adopts the attacker-controlled hostname, redirecting relative HttpClient requests to an attacker-controlled server. (CVE-2026-46417)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a     Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from     how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry     points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal     ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the current     hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are     redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.
    This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22. (CVE-2026-46417)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115612	Angular < 19.2.22 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115611	Angular 19.x < 19.2.22 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115610	Angular 20.x < 20.3.21 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115609	Angular 21.x < 21.2.13 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
322245	Linux Distros Unpatched Vulnerability : CVE-2026-46417	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-46417

high

Tenable Plugins

high

high

high

high

high