From d19a53e57b0575f46183923b4b76442d0cc995d6 Mon Sep 17 00:00:00 2001
From: deprrous <sukhbatsuugii2004@gmail.com>
Date: Wed, 29 Jul 2026 19:03:49 +0800
Subject: [PATCH] fix(@angular/build): add host validation to internal SSR
 middleware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The internal SSR middleware (createAngularSsrInternalMiddleware) calls
AngularServerApp.handle() directly without validating the request
hostname against the configured allowedHosts. The external middleware
correctly propagates the allowedHosts check via
AngularAppEngine.ɵdisableAllowedHostsCheck, but the internal path
has no equivalent validation.

When allowedHosts is configured (not set to true), validate the
request URL hostname before passing the request to the SSR engine.
This prevents hostname hijacking via DNS rebinding when the dev
server is exposed on 0.0.0.0.
---
 .../tools/vite/middlewares/ssr-middleware.ts    | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/angular/build/src/tools/vite/middlewares/ssr-middleware.ts b/packages/angular/build/src/tools/vite/middlewares/ssr-middleware.ts
index a26fa8e5e257..a3cc63e0d73e 100644
--- a/packages/angular/build/src/tools/vite/middlewares/ssr-middleware.ts
+++ b/packages/angular/build/src/tools/vite/middlewares/ssr-middleware.ts
@@ -23,6 +23,9 @@ export function createAngularSsrInternalMiddleware(
 ): Connect.NextHandleFunction {
   let cachedAngularServerApp: ReturnType<typeof getOrCreateAngularServerApp> | undefined;
 
+  const { allowedHosts } = server.config.server;
+  const disableAllowedHostsCheck = allowedHosts === true;
+
   return function angularSsrMiddleware(
     req: Connect.IncomingMessage,
     res: ServerResponse,
@@ -62,6 +65,20 @@ export function createAngularSsrInternalMiddleware(
       const webReq = new Request(createWebRequestFromNodeRequest(req), {
         signal: AbortSignal.timeout(30_000),
       });
+
+      if (!disableAllowedHostsCheck && Array.isArray(allowedHosts) && allowedHosts.length > 0) {
+        const { hostname } = new URL(webReq.url);
+        const isAllowed = allowedHosts.some(
+          (host) => hostname === host || hostname.endsWith(`.${host}`),
+        );
+        if (!isAllowed) {
+          res.statusCode = 400;
+          res.end('Bad Request: Host not allowed.');
+
+          return;
+        }
+      }
+
       const webRes = await angularServerApp.handle(webReq);
       if (!webRes) {
         return next();