{"id":"CVE-2025-62427","aliases":["GHSA-q63q-pgmf-mxhr"],"url":"https://o3.security/vulnerability/CVE-2025-62427","summary":"Server-Side Request Forgery (SSRF) in Angular SSR","details":"### Impact\nThe vulnerability is a **Server-Side Request Forgery (SSRF)** flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (`@angular/ssr`).\n\nThe function `createRequestUrl` uses the native `URL` constructor. When an incoming request path (e.g., `originalUrl` or `url`) begins with a **double forward slash (`//`) or backslash (`\\\\`)**, the `URL` constructor treats it as a **schema-relative URL**. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname.\n\nThis allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via `DOCUMENT` or `PlatformLocation` tokens) to this attacker-controlled domain. Any subsequent **relative HTTP requests** made during the SSR process (e.g., using `HttpClient.get('assets/data.json')`) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint.\n\n#### Exploit Scenario\nA request to `http://localhost:4200//attacker-domain.com/some-page` causes Angular to believe the host is attacker-domain.com. A relative request to api/data then becomes a server-side request to `http://attacker-domain.com/api/data`.\n\n### Patches\n\n- `@angular/ssr` 19.2.18\n- `@angular/ssr` 20.3.6\n- `@angular/ssr` 21.0.0-next.8\n\n## Mitigation\n\nThe application's internal location must be robustly determined from the incoming request. The fix requires sanitizing or validating the request path to prevent it from being interpreted as a schema-relative URL (i.e., ensuring it does not start with `//`).\n\n#### Server-Side Middleware\nIf you can't upgrade to a patched version, implement a **middleware** on the Node.js/Express server that hosts the Angular SSR application to explicitly reject or sanitize requests where the path begins with a double slash (`//`).\n\n**Example (Express/Node.js):**\n\n```ts\n// Place this middleware before the Angular SSR handler\napp.use((req, res, next) => {\n  if (req.originalUrl?.startsWith('//')) {\n    // Sanitize by forcing a single slash\n    req.originalUrl = req.originalUrl.replace(/^\\/\\/+/, '/');\n    req.url = req.url.replace(/^\\/\\/+/, '/');\n  }\n  next();\n});\n```\n\n### References\n\n- Report: https://github.com/angular/angular-cli/issues/31464\n- Fix:  https://github.com/angular/angular-cli/pull/31474","published":"2025-10-16T18:50:11.598Z","modified":"2026-08-12T03:51:42.287116657Z","cvss":null,"epss":{"score":0.00403,"percentile":0.33121,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@angular/ssr","fixedVersion":"19.2.18"},{"ecosystem":"npm","name":"@angular/ssr","fixedVersion":"20.3.6"},{"ecosystem":"npm","name":"@angular/ssr","fixedVersion":"21.0.0-next.8"}],"fix":{"url":"https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb","label":"angular/angular-cli@5271547"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62427.json"},{"type":"ADVISORY","url":"https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62427"},{"type":"FIX","url":"https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb"},{"type":"PACKAGE","url":"https://github.com/angular/angular-cli"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.287116657Z"}}