CVE-2026-46417 is an SSRF vulnerability in @angular/platform-server affecting versions up to 18.2.14. The vulnerability arises because the server-side rendering engine's ServerPlatformLocation can be hijacked by passing an absolute-form URL, causing the internal hostname to be set to an attacker-controlled domain. This leads to relative HttpClient requests and PlatformLocation.hostname references being redirected to malicious servers, potentially exposing sensitive internal resources. The vulnerability is addressed by adding an allowedHosts configuration option to the renderModule and renderApplication functions, which restricts hostnames to a trusted allowlist. Patch versions include 19.2.22, 20.3.21, 21.2.13, and 22.0.0-next.12. Workarounds involve validating or normalizing request URLs before rendering to prevent hostname hijacking.

An attacker can cause the server-side rendering engine to redirect internal HTTP requests to attacker-controlled domains by manipulating the hostname. This can lead to exposure of internal APIs or metadata services that rely on relative URLs, potentially compromising sensitive information or internal infrastructure.

Official patches are available in versions 19.2.22, 20.3.21, 21.2.13, and 22.0.0-next.12 of @angular/platform-server. Users should upgrade to one of these versions to mitigate the vulnerability. For those unable to upgrade immediately, implement strict URL validation or normalization in the server entry point to ensure that only trusted hostnames are processed by the rendering engine. For example, validate the request host header against a trusted list and reject requests from untrusted hosts before calling renderApplication or renderModule.