CVE-2026-88056 is a critical (CVSS 9.1) server-side request forgery in @angular/platform-server. A leading Unicode space is stripped after a same-origin check, so a relative path can become an attacker-controlled address, and server credentials may be sent there. Upgrade to 20.3.30, 21.2.22 or 22.1.4.
What's affected
Angular Server-Side Rendering in @angular/platform-server is affected before these releases:
- 20.3.30 on the 20 line
- 21.2.22 on the 21 line
- 22.1.4 on the 22 line
Not all apps are exposed. The advisory text in the record says the harm occurs in affected applications that attach sensitive server-side credentials, such as Authorization headers, to requests that application code has approved. Apps that render on the server but add no credentials have less to lose.
How to check if you're exposed
Check the installed version of the server platform package in each project:
npm ls @angular/platform-server
Run it in every application, and in monorepo workspaces run it from the root. Lockfiles are the better source of truth for deployed builds:
grep -A2 '"node_modules/@angular/platform-server"' package-lock.json
Then search your server code for places where it adds an Authorization header or another secret to outbound requests made through HttpClient during rendering. Interceptors are the usual place. If your app does that, treat the finding as high priority.
What to do now
- Upgrade @angular/platform-server to 20.3.30, 21.2.22 or 22.1.4, according to your major version.
- Keep other Angular packages on matching versions, then rebuild and redeploy the server bundle.
- Review server interceptors that attach credentials, and attach them only for requests to known hosts.
- Rotate tokens that your server sends on outbound requests if you suspect misuse.
- Add outbound request logging on the render server so unexpected hosts stand out.
Even after the patch, the safest design is one where credentials are only added for an explicit list of hosts. Check the destination in the interceptor, using a parsed URL and a strict comparison, instead of trusting that a request is internal because it started as a relative path.
Server rendering also runs close to your network. A render server that can reach internal services, or a cloud metadata address, makes any request forgery bug more valuable. Limit its outbound access with egress rules if your platform supports them.
Why it matters
The weakness is CWE-918 (server-side request forgery). The advisory describes a mismatch between two pieces of code. Application code checks that a URL is same-origin using the standard URL parser. Later, Angular utility functions called trim, which removes certain leading Unicode whitespace such as non-breaking space or a byte order mark. After the trim, the string that passed the check became a protocol-relative address, and the request interceptor sent it, with credentials attached, to the other origin.
This is a validation gap: the value was checked in one form and used in another. The fix avoids stripping Unicode whitespace during URL resolution, so the checked value and the used value agree.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
Three version lines each have a fix. A view of which fix applies to which of your projects saves guesswork.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if my app is client-side only?
The flaw is in the server platform package. Apps that never use @angular/platform-server are not in this path.
Which version do I pick?
The fix for your major line: 20.3.30, 21.2.22 or 22.1.4.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
- https://github.com/angular/angular/releases/tag/v20.3.30
- https://github.com/angular/angular/releases/tag/v21.2.22
- https://github.com/angular/angular/releases/tag/v22.1.4
Last reviewed: 19 October 2026.
