Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side
    Rendering in @angular/platform-server processes user-controlled resource or request URLs through
    HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl
    utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or
    U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative
    attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as
    Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the
    request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in
    versions 20.3.30, 21.2.22, and 22.1.4. (CVE-2026-88056)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side     Rendering in @angular/platform-server processes user-controlled resource or request URLs through     HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl     utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or     U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative     attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as     Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the     request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in     versions 20.3.30, 21.2.22, and 22.1.4. (CVE-2026-88056)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447943	SCA: security update for @angular/platform-server (GHSA-f6mr-pjwc-34m4)	Tenable Cloud Security	SCA Checks	Local	high
447943	SCA: security update for @angular/platform-server (GHSA-f6mr-pjwc-34m4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344697	Linux Distros Unpatched Vulnerability : CVE-2026-88056	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88056

high

Tenable Plugins

high

high

high