npm/@angular/platform-server CVE-2026-88056: high
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Action: Upgrade @angular/platform-server to 20.3.30 or later.
npm i @angular/platform-server@22.1.4npm i @angular/platform-server@21.2.22npm i @angular/platform-server@20.3.30Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.1.4 | - |
| 21.0.0 | 21.2.22 | - |
| 20.0.0 | 20.3.30 | - |
| 0 | - | 19.2.25 |
Fixed versions
| 22.1.4 | 21.2.22 | 20.3.30 |
Sources
- osv: GHSA-f6mr-pjwc-34m4
- https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
- https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
- https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
- https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
- https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599
- https://github.com/angular/angular
- https://github.com/angular/angular/releases/tag/v20.3.30
- https://github.com/angular/angular/releases/tag/v21.2.22
- https://github.com/angular/angular/releases/tag/v22.1.4
CVE-2026-88056 · published · modified · JSON