VDB
CVE-2026-88056
CVE-2026-88056
PUBLISHED
CVSS 8.600000381469727 HIGH
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
EPSS 0.54% · 45.4th percentile
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.54%
45.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| angular | angular | 22.0.0, 0, 20.0.0 |
| angular | platform-server | 0, 20.0.0, 21.0.0 |
Timeline
- Sep 10, 2026 CVE Published
- Sep 10, 2026 Coalition ESS Score
- Sep 11, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 9, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-88056 advisory
- https://github.com/advisories/GHSA-f6mr-pjwc-34m4 advisory
- https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4 url
- https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c patch
- https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132 patch
- https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970 patch
- https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599 patch
- https://github.com/angular/angular/releases/tag/v20.3.30 url
- https://github.com/angular/angular/releases/tag/v21.2.22 url
- https://github.com/angular/angular/releases/tag/v22.1.4 url