The vulnerability (CVE-2026-88056) in @angular/platform-server involves a mismatch in URL parsing behavior between the WHATWG URL standard and Angular SSR's URL resolution utilities. Specifically, URLs containing leading Unicode whitespace characters such as NO-BREAK SPACE (U+00A0) pass same-origin checks when validated with WHATWG URL parsing because these characters are not stripped. However, Angular's URL resolution functions trim these characters using JavaScript's String.prototype.trim(), which removes all Unicode whitespace, converting the URL into a cross-origin protocol-relative URL. This causes server-side HTTP requests to be sent to attacker-controlled origins, leaking sensitive credentials attached to the request. The vulnerability affects Angular SSR applications that use HttpClient with user-controlled URLs and attach sensitive headers after same-origin validation. The affected versions are Angular platform-server versions >=20.0.0 <20.3.30, >=21.0.0 <21.2.22, >=22.0.0 <22.1.4, and <=19.2.25. A patch is available.

Exploitation allows attackers to bypass same-origin validation in Angular SSR applications, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials such as Authorization headers or API keys. This can lead to unauthorized access or data exfiltration from the server environment. The vulnerability is reachable when user input influences URLs processed by Angular's HttpClient and sensitive credentials are attached to requests after origin checks.

A patch is available for this vulnerability. Users should upgrade to fixed versions of @angular/platform-server as indicated by the vendor. Until patched, applications should sanitize input URLs to disallow leading Unicode whitespace characters (e.g., U+00A0) before performing origin checks or passing them to HttpClient. Additionally, do not rely solely on WHATWG URL origin validation if the input may be trimmed or normalized differently by other utilities. Follow vendor advisories for official remediation guidance.