This PR was merged into the repository. The changes were merged into the following branches:

• main: bcd99f9
• 21.2.x: b1fe66a

Hi @alan-agius4 ,

I have a question regarding the real-world impact of this vulnerability. From my understanding, this bug bypasses the .get('host') validation if a developer iterates over the headers using req.headers.forEach().

However, I would assume developers typically only use forEach when they need to forward specific headers like Authorization, Cookies, etc. Moreover, the correct pre-validated Host information is usually already available directly on the generic request object created by Angular/Node.

``
const hostname =
getFirstHeaderValue(headers['x-forwarded-host']) ?? headers.host ?? headers[':authority'];

``

Given that, would a developer actually have any reason to try and manually pull the Host header out via forEach? I wouldn't think this is a widely used behavior by Angular developers. Could you clarify if there are common real-world use cases where developers were doing this and accidentally creating a vulnerability?

@VenkatKwest, in general I would not expect the forEach to be used that much.