{"action":"Upgrade @angular/platform-server to 20.3.30 or later.","affected":[{"fixed":"22.1.4","introduced":"22.0.0"},{"fixed":"21.2.22","introduced":"21.0.0"},{"fixed":"20.3.30","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-88056"],"ecosystem":"npm","epss":0.00541,"exploited":false,"fixed_versions":["22.1.4","21.2.22","20.3.30"],"ghsa_id":"GHSA-f6mr-pjwc-34m4","id":"tcs_01M5KFMPTXPX7PNBM2CD3GJQ1S","modified_at":"2026-09-10T20:30:04.442574905Z","published_at":"2026-09-10T20:19:43Z","references":["https://osv.dev/vulnerability/GHSA-f6mr-pjwc-34m4","https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4","https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c","https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132","https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970","https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599","https://github.com/angular/angular","https://github.com/angular/angular/releases/tag/v20.3.30","https://github.com/angular/angular/releases/tag/v21.2.22","https://github.com/angular/angular/releases/tag/v22.1.4"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-f6mr-pjwc-34m4","url":"https://osv.dev/vulnerability/GHSA-f6mr-pjwc-34m4"}],"summary":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR"}