CVE-2026-27739
3 advisories.
npm/@angular/ssr CVE-2026-27739: critical
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Action: Upgrade @angular/ssr to 19.2.21 or later.
npm i @angular/ssr@21.2.0-rc.1npm i @angular/ssr@21.1.5npm i @angular/ssr@20.3.17npm i @angular/ssr@19.2.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 21.2.0-next.0 | 21.2.0-rc.1 | - |
| 21.0.0-next.0 | 21.1.5 | - |
| 20.0.0-next.0 | 20.3.17 | - |
| 0 | 19.2.21 | - |
Fixed versions
| 21.2.0-rc.1 | 21.1.5 | 20.3.17 | 19.2.21 |
Sources
- osv: GHSA-x288-3778-4hhx
- https://github.com/angular/angular-cli/security/advisories/GHSA-x288-3778-4hhx
- https://nvd.nist.gov/vuln/detail/CVE-2026-27739
- https://github.com/angular/angular-cli/pull/32516
- https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf
- https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF
- https://github.com/angular/angular-cli
CVE-2026-27739 · published · modified · JSON
npm/@nguniversal/common CVE-2026-27739: critical
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 16.2.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-x288-3778-4hhx#npm/@nguniversal/common
- https://github.com/angular/angular-cli/security/advisories/GHSA-x288-3778-4hhx
- https://nvd.nist.gov/vuln/detail/CVE-2026-27739
- https://github.com/angular/angular-cli/pull/32516
- https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf
- https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF
- https://github.com/angular/angular-cli
CVE-2026-27739 · published · modified · JSON
npm/@nguniversal/express-engine CVE-2026-27739: critical
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 16.2.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-x288-3778-4hhx#npm/@nguniversal/express-engine
- https://github.com/angular/angular-cli/security/advisories/GHSA-x288-3778-4hhx
- https://nvd.nist.gov/vuln/detail/CVE-2026-27739
- https://github.com/angular/angular-cli/pull/32516
- https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf
- https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF
- https://github.com/angular/angular-cli
CVE-2026-27739 · published · modified · JSON