Vulnerabilities in pkg:npm/@nguniversal/express-engine

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x288-3778-4hhx",
  "modified" : "2026-02-25T22:42:36Z",
  "published" : "2026-02-25T22:42:36Z",
  "aliases" : [ "CVE-2026-27739" ],
  "summary" : "Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline",
  "details" : "A [Server-Side Request Forgery (SSRF)](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF) vulnerability has been identified in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the destination domain.\n\nSpecifically, the framework didn't have checks for the following:\n- **Host Domain**: The `Host` and `X-Forwarded-Host` headers were not checked to belong to a trusted origin. This allows an attacker to redefine the \"base\" of the application to an arbitrary external domain.\n- **Path & Character Sanitization**: The `X-Forwarded-Host` header was not checked for path segments or special characters, allowing manipulation of the base path for all resolved relative URLs.\n- **Port Validation**: The `X-Forwarded-Port` header was not verified as numeric, leading to malformed URI construction or injection attacks.\n\n\nThis vulnerability manifests in two primary ways:\n\n- **Implicit Relative URL Resolution**: Angular's `HttpClient` resolves relative URLs against this unvalidated and potentially malformed base origin. An attacker can \"steer\" these requests to an external server or internal service.\n- **Explicit Manual Construction**: Developers injecting the `REQUEST` object to manually construct URLs (for fetch or third-party SDKs) directly inherit these unsanitized values. By accessing the `Host` / `X-Forwarded-*` headers, the application logic may perform requests to attacker-controlled destinations or malformed endpoints.\n\n### Impact\n\nWhen successfully exploited, this vulnerability allows for arbitrary internal request steering. This can lead to:\n- **Credential Exfiltration**: Stealing sensitive `Authorization` headers or session cookies by redirecting them to an attacker's server.\n- **Internal Network Probing**: Accessing and transmitting data from internal services, databases, or cloud metadata endpoints (e.g., `169.254.169.254`) not exposed to the public internet.\n- Confidentiality Breach: Accessing sensitive information processed within the application's server-side context.\n\n### Attack Preconditions\n\n- The victim application must use Angular SSR (Server-Side Rendering).\n- The application must perform `HttpClient` requests using relative URLs OR manually construct URLs using the unvalidated `Host` / `X-Forwarded-*` headers using the `REQUEST` object.\n- **Direct Header Access**: The application server is reachable by an attacker who can influence these headers without strict validation from a front-facing proxy.\n- **Lack of Upstream Validation**: The infrastructure (Cloud, CDN, or Load Balancer) does not sanitize or validate incoming headers.\n\n### Patches\n\n- 21.2.0-rc.1\n- 21.1.5\n- 20.3.17\n- 19.2.21\n\n\n### Workarounds\n- **Use Absolute URLs:** Avoid using `req.headers` for URL construction. Instead, use trusted variables for your base API paths.\n- **Implement Strict Header Validation (Middleware)**: If you cannot upgrade immediately, implement a middleware in your `server.ts` to enforce numeric ports and validated hostnames.\n\n```ts\nconst ALLOWED_HOSTS = new Set(['your-domain.com']);\n\napp.use((req, res, next) => {\n  const hostHeader = (req.headers['x-forwarded-host'] ?? req.headers['host'])?.toString();\n  const portHeader = req.headers['x-forwarded-port']?.toString();\n\n  if (hostHeader) {\n    const hostname = hostHeader.split(':')[0];\n    // Reject if hostname contains path separators or is not in allowlist\n    if (/^[a-z0-9.:-]+$/i.test(hostname) || \n       (!ALLOWED_HOSTS.has(hostname) && hostname !== 'localhost')) {\n      return res.status(400).send('Invalid Hostname');\n    }\n  }\n\n  // Ensure port is strictly numeric if provided\n  if (portHeader && !/^\\d+$/.test(portHeader)) {\n    return res.status(400).send('Invalid Port');\n  }\n\n  next();\n});\n```\n\n### References\n\n- [Fix](https://github.com/angular/angular-cli/pull/32516)\n- [Docs](https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/ssr"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "21.2.0-next.0"
      }, {
        "fixed" : "21.2.0-rc.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 21.2.0-rc.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/ssr"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "21.0.0-next.0"
      }, {
        "fixed" : "21.1.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/ssr"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "20.0.0-next.0"
      }, {
        "fixed" : "20.3.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/ssr"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "19.2.21"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@nguniversal/common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "16.2.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@nguniversal/express-engine"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "16.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular-cli/security/advisories/GHSA-x288-3778-4hhx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-27739"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular-cli/pull/32516"
  }, {
    "type" : "WEB",
    "url" : "https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf"
  }, {
    "type" : "WEB",
    "url" : "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/angular/angular-cli"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-25T22:42:36Z",
    "nvd_published_at" : "2026-02-25T18:23:40Z"
  }
}