CVE-2026-88056

Executive Summary

CVE-2026-88056 is a server-side request forgery (SSRF) and credential disclosure flaw in Angular's Server-Side Rendering (SSR) implementation within @angular/platform-server. Applications that validate user-controlled resource or request URLs using WHATWG URL parsing and then attach sensitive server-side credentials (such as Authorization headers) to approved requests are vulnerable to having those credentials redirected to an attacker-controlled origin. The vulnerability is fixed in @angular/platform-server versions 20.3.30, 21.2.22, and 22.1.4; all earlier versions within the affected release trains should be considered impacted.

Technical Analysis

The flaw resides in the URL resolution utilities resolveUrl and parseUrl used by Angular SSR's @angular/platform-server package. The root cause is a normalization mismatch between security validation and URL construction: application code performs a same-origin check using WHATWG URL parsing, which treats certain leading Unicode whitespace characters (specifically U+00A0 non-breaking space and U+FEFF byte order mark / zero-width no-break space) as part of the URL and evaluates it accordingly.

Subsequently, the internal Angular utilities resolveUrl and parseUrl invoke String.prototype.trim() on the input. String.prototype.trim() removes a broader set of Unicode whitespace than the WHATWG URL parser's leading/trailing C0-control-and-space stripping. This discrepancy means that an input that passed the same-origin validation as a relative path — because the parser saw the leading whitespace as part of the path segment — can be silently transformed after validation. When the leading whitespace is stripped by trim(), the remaining string begins with //, which is a protocol-relative URL. A protocol-relative URL such as //attacker.example/path is resolved by HttpClient against the current scheme and dispatched to the attacker-controlled host, not the original same-origin host.

The critical trust boundary violation occurs because application code had already approved the request as same-origin and attached sensitive server-side credentials — for example an Authorization header — before the URL was mutated. At dispatch time, relativeUrlsTransformerInterceptorFn — the interceptor responsible for transforming relative URLs into absolute URLs in the SSR request pipeline — forwards the now protocol-relative, attacker-controlled URL along with the previously attached credentials. The result is two-fold impact: (1) SSRF, where the SSR server makes an outbound request to an origin chosen by the attacker, and (2) credential disclosure, where server-side secrets (tokens, API keys, session material) are transmitted to that attacker origin.

The attack surface is the SSR HTTP request pipeline in Node.js-hosted Angular applications that process user-influenced URLs. Because the flaw is a normalization/comparison inconsistency (a classic parser-differential or canonicalization bug), it does not require memory corruption, injection, or authentication bypass — only that an attacker controls the value of a URL that reaches the affected utilities after an application-level same-origin check.

Exploitation Scenarios

No public proof-of-concept exists at the time of writing; the attack chain below is inferred from the vulnerability class (CWE-918 SSRF via parser-differential canonicalization) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an Angular application using Server-Side Rendering (@angular/platform-server) that accepts a user-controlled URL — for example a resource path, request target, or callback parameter — and that the application then validates as same-origin before issuing a server-side HttpClient request. Evidence of Angular SSR is visible via the ng-version attribute in served HTML and Angular-specific asset paths.

2. Triggering the flaw class. The attacker supplies a crafted input that is a relative path prefixed with Unicode whitespace, specifically U+00A0 or U+FEFF, followed by a protocol-relative URL such as \u00A0//attacker.example/path. During the application's WHATWG URL parsing-based same-origin check, the leading whitespace causes the string to be interpreted as a safe relative path, so the request is approved. When resolveUrl/parseUrl subsequently apply String.prototype.trim(), the leading Unicode whitespace is removed, yielding //attacker.example/path, a protocol-relative URL.

3. Payload / execution method. With the URL now protocol-relative, relativeUrlsTransformerInterceptorFn resolves it against the application's scheme and dispatches the request to attacker.example rather than the intended same-origin host. Because the application already attached sensitive server-side credentials (e.g., an Authorization header) to the approved request, those credentials travel with the outbound request.

4. Post-exploitation impact. The attacker-controlled origin receives the server-side credentials and the request metadata, enabling credential theft, lateral movement, and abuse of the compromised service's privileges. The SSR server is also coerced into making outbound requests to arbitrary origins (SSRF), which can be used for internal network probing, cloud metadata access, or as a pivot into restricted network segments.

The exploit is passive from the attacker's perspective: no code execution is required, and the successful signal is simply an inbound request to an attacker-controlled endpoint containing the leaked credential. No specific exploit code, endpoints, or parameter names can be asserted beyond those present in the NVD description.

Impact Assessment

The vulnerability class is CWE-918 (Server-Side Request Forgery), with secondary impact of sensitive information disclosure via credential exposure. Although no CVSS score or vector was published by NVD, the inherent characteristics are high: network attack vector, no privileges required, no user interaction required, and a scope change because the SSR server acts as a proxy to attacker infrastructure. Confidentiality impact is high (server-side credentials such as Authorization headers are disclosed to a third party); integrity and availability impacts are typically low unless the leaked credentials enable further compromise. Affected systems are Node.js-hosted Angular SSR deployments within the affected version ranges (prior to 20.3.30, 21.2.22, and 22.1.4). Blast radius is potentially large for multi-tenant or cloud-hosted front-ends, since a single leaked credential may grant access to backend APIs, cloud services, or internal microservices. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential Angular SSR SSRF via Unicode Whitespace URL Normalization Bypass id: 8f2a1c94-6b3d-4e21-9c77-4a2f9b0e77c1 status: experimental description: Detects outbound HTTP requests originating from Angular SSR hosts whose URL paths contain protocol-relative targets or encoded Unicode whitespace following a url resolution step. references:

• https://nvd.nist.gov/vuln/detail/CVE-2026-88056 author: valtersit.com date: 2026-01-01 logsource: category: proxy detection: selection_unicode: cs-uri|contains:
  • '%C2%A0'
  • '%EF%BB%BF'
  • '\u00A0'
  • '\uFEFF' selection_relative: cs-uri|re: '^//[a-zA-Z0-9.-]+/' condition: selection_unicode or selection_relative falsepositives:
• Legitimate applications encoding non-breaking spaces in path segments level: medium tags:
• attack.initial_access
• attack.t1190
• cwe.918

YARA Rule

rule Angular_SSR_SSRF_UnicodeTrim_Bypass
{
    meta:
        description = "Detects Angular SSR platform-server code paths referencing resolveUrl/parseUrl and trim-based normalization near URL handling"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88056"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "resolveUrl" ascii
        $b = "parseUrl" ascii
        $c = "relativeUrlsTransformerInterceptorFn" ascii
        $d = "String.prototype.trim" ascii
        $e = "platform-server" ascii
    condition:
        filesize < 5MB and
        (uint16(0) == 0x4D5A or uint32(0) == 0x6A736E21 or uint32(0) == 0x23212F2F) and
        (($a or $b) and ($c or $e))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88056 Possible Angular SSR SSRF via Unicode Whitespace URL Normalization Bypass"; flow:established,to_server; http.uri; content:"%C2%A0"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-88056; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88056; sid:8805601; rev:1;)

alert http any any -> any any (msg:"CVE-2026-88056 Possible Angular SSR SSRF via BOM-Prefixed URL"; flow:established,to_server; http.uri; content:"%EF%BB%BF"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-88056; sid:8805602; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s [process where process.name == "node" and process.args : "platform-server"] [network where event.category == "network" and destination.port in (80, 443) and not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]

Splunk SPL Query

index=proxy OR index=web | search (cs_uri_query="%C2%A0" OR cs_uri_query="%EF%BB%BF" OR cs_uri_path="//*") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, cs_uri_path, cs_uri_query, http_user_agent | where count > 0 | convert ctime(first_seen) ctime(last_seen) | sort - count

Wazuh OSSEC Rule

json \.*%C2%A0|\.*%EF%BB%BF CVE-2026-88056 - Possible Angular SSR SSRF attempt using Unicode whitespace-encoded URL (U+00A0/U+FEFF) T1190 json ^//[a-zA-Z0-9.-]+/ CVE-2026-88056 - Protocol-relative URL detected in Angular SSR request pipeline (possible SSRF) T1190

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no CVE-specific vendor advisory or workaround is currently documented, defensive measures should target the underlying mechanism. Avoid forwarding user-controlled values directly into HttpClient requests after same-origin validation. Where feasible, disable or tightly restrict SSR's URL resolution for user-influenced inputs; validate URLs with a strict allowlist of exact origins rather than relying on WHATWG URL parsing plus a same-origin comparison. Do not attach sensitive server-side credentials (e.g., Authorization headers) to requests whose URL derives from user input. As an interim compensating control, reject inputs containing leading or embedded Unicode whitespace (U+00A0, U+FEFF) before they reach the URL resolution utilities.

2. Patch / upgrade steps. The NVD description states the issue is fixed in @angular/platform-server versions 20.3.30, 21.2.22, and 22.1.4. Upgrade affected deployments to at least the fixed version in the corresponding release train. Note that these version references come from the NVD description only; because no vendor advisory or patch source is tracked in this dataset (Patch Sources: []), the patch should be independently verified against the official Angular release channels before deployment.

3. Long-term hardening. Enforce consistent URL canonicalization between security checks and request dispatch — the vulnerability is fundamentally a parser-differential normalization mismatch, so validators and consumers should use the same normalization routine and operate on the same canonical form. Apply SSRF egress controls (network egress allowlists, blocking of cloud metadata endpoints), segregate SSR processes from privileged credential stores, and adopt least-privilege service accounts so leaked SSR credentials have limited blast radius. Monitor the Angular project's security advisories for the authoritative fix and any backported releases.

References

• NVD — CVE-2026-88056: https://nvd.nist.gov/vuln/detail/CVE-2026-88056
• Angular project security advisories and release notes (verify fixed versions 20.3.30, 21.2.22, 22.1.4 against official Angular release channels)
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• WHATWG URL Standard (relevant to the parser-differential behavior described): https://url.spec.whatwg.org/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or exploit-in-the-wild evidence are available for CVE-2026-88056 at the time of writing. The CVE is not listed in CISA KEV, no public PoC or exploit code has been observed, and no Nuclei template is associated with this identifier.

[ API_PRO ] →

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2026-88056/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub