A high-severity Server-Side Request Forgery vulnerability in Angular allows unauthenticated attackers to potentially exfiltrate sensitive server-side credentials.

This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) caused by the incorrect use of String.prototype.trim() on URLs. The flaw allows an unauthenticated attacker to bypass same-origin checks by injecting Unicode whitespace, forcing the server to dispatch requests to attacker-controlled origins.

The vulnerability carries a CVSS score of 8.6, reflecting the high risk of unauthorized access to sensitive internal resources. Successful exploitation enables an attacker to intercept server-side authorization headers, leading to potential data breaches, unauthorized API access, and the compromise of internal network segments that rely on server-side identity for authentication.

Immediate Action: Update the @angular/platform-server package to version 20.3.30, 21.2.22, or 22.1.4 respectively, based on your current deployment branch.

Proactive Monitoring: Review web application and proxy logs for unusual outbound requests originating from the server to external or unexpected internal domains.

Compensating Controls: Implement strict egress filtering on the server hosting the Angular application to prevent unauthorized outbound connections to untrusted external origins.

Public Exploit Available: No

Given the potential for credential theft and the high CVSS severity, organizations utilizing Angular Server-Side Rendering must prioritize patching this vulnerability. Administrators should verify their current versioning and apply the provided updates immediately to ensure that URL validation logic is correctly hardened against Unicode whitespace manipulation.