Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Description

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Angular SSR request handling pipeline.

Recommendation

No fix is available yet. Followings are affected versions:

<= 16.2.0

References

Could your website be exposed too?

SmartScanner can check your website for Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline and gives you actionable findings to investigate.

Start a free scan

Related Issues

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd - CVE-2026-4800
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
Axios: Header Injection via Prototype Pollution - CVE-2026-42035

CSRF, XXE, and 12 Other Security Acronyms Explained

Host Header Injection and Python Tests with SmartScanner 1.11

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated February 25, 2026