CVE-2025-62427: SSRF Vulnerability in @angular/ssr Package
Summary
CVE-2025-62427: Angular SSR has a Server-Side Request Forgery (SSRF) flaw. Affects @angular/ssr across 3 version ranges.
>= 19.0.0-next.0, < 19.2.18
>= 20.0.0-next.0, < 20.3.6
>= 21.0.0-next.0, < 21.0.0-next.8
Fixed in 19.2.18, 20.3.6 or 21.0.0-next.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/ssr package is a part of the Angular framework that enables server-side rendering of Angular applications. This functionality allows for improved performance and SEO by rendering pages on the server before sending them to the client. However, the package has a vulnerability that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr). The function createRequestUrl uses the native URL constructor, which can be manipulated by an attacker. If an incoming request path begins with double forward slashes (//) or backslashes (), the URL constructor treats it as a schema-relative URL, allowing the attacker to specify an external domain. This can lead to the server making unintended requests to an external endpoint, potentially exposing sensitive data or allowing further attacks.
How To Fix
Latest published version: 22.2.4 as of 22 Oct 2026
npm install @angular/ssr@22.2.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 19.0.0-next.0, < 19.2.1819.2.18npm install @angular/ssr@19.2.18 -
>= 20.0.0-next.0, < 20.3.620.3.6npm install @angular/ssr@20.3.6 -
>= 21.0.0-next.0, < 21.0.0-next.821.0.0-next.8npm install @angular/ssr@21.0.0-next.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not possible, implement middleware on your Node.js/Express server to sanitize incoming requests. Place the following middleware before the Angular SSR handler:
app.use((req, res, next) => {
if (req.originalUrl?.startsWith('//')) {
req.originalUrl = req.originalUrl.replace(/^\//, '/');
req.url = req.url.replace(/^\//, '/');
}
next();
});
Conclusion
The CVE-2025-62427 vulnerability in the @angular/ssr package poses a significant risk due to its SSRF nature. It is crucial to update to the patched versions or implement the suggested workarounds to mitigate potential attacks.
See every vulnerability recorded for @angular/ssr →
FAQ
SSRF is a vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to data exposure or further attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to unauthorized access to external services, data leakage, and potential compromise of the server.
While the package has a known vulnerability, it is safe to use as long as you update to the patched versions or implement the recommended workarounds.
If upgrading is not an option, implement the provided middleware to sanitize incoming requests and prevent exploitation of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/ssr.
