Fix @angular/ssr CVE-2026-27739 — SSRF via Unvalidated Headers

Updated April 10, 2026 · CRITICAL · CVSS 9.2 · GHSA-x288-3778-4hhx

CVE-2026-27739 is a Server-Side Request Forgery (SSRF) vulnerability in Angular's SSR engine. The createRequestUrl() function trusts Host and X-Forwarded-Host headers without validation — an attacker who controls those headers turns your SSR server into an open proxy. Angular 18 and below have no patch.

Fix — update @angular/ssr

# Angular 19 users
npm install @angular/ssr@19.2.21

# Angular 20 users
npm install @angular/ssr@20.3.17

# Angular 21 users
npm install @angular/ssr@21.1.5

# Verify
npm list @angular/ssr

Workaround for Angular 18 and below (no patch available)

Add header validation middleware in server.ts before Angular SSR handles requests:

// server.ts
const ALLOWED_HOSTS = new Set(['your-domain.com', 'www.your-domain.com']);

app.use((req, res, next) => {
  const host = (req.headers['x-forwarded-host'] ?? req.headers['host'] ?? '').toString();
  const hostname = host.split(':')[0];
  if (!ALLOWED_HOSTS.has(hostname)) {
    delete req.headers['x-forwarded-host'];
    delete req.headers['x-forwarded-port'];
  }
  next();
});

Root cause — createRequestUrl()

The vulnerability is in packages/angular/ssr/node/src/request.ts. The createRequestUrl() function reads host and x-forwarded-host headers to build the base URL for SSR rendering. Before the patch, no domain validation existed. An attacker sets X-Forwarded-Host: evil.com — all relative HttpClient calls in your SSR app now resolve against evil.com, forwarding Authorization headers and cookies.

Cloud metadata risk

Vulnerability data sourced from the OSV database and public package registries. Always test dependency updates in a staging environment before deploying to production. PackageFix provides these tools for informational purposes only and cannot guarantee that pinned versions are free from undiscovered vulnerabilities.