CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Attackers can bypass SSRF allowlists in Angular server-side rendering by exploiting URL parser differences to force requests to arbitrary external endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50168?
CVE-2026-50168 is a high-severity server-side request forgery vulnerability in angular, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino's internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Which versions are affected by CVE-2026-50168?
10 open source packages ship an affected version, including @angular/platform-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/platform-server npm | All versions to 18.2.14 | None |
@angular/platform-server npm | All versions to 18.2.14 | None |
@angular/platform-server npm | From 19.0.0-next.0 | 19.2.23 |
@angular/platform-server npm | From 19.0.0-next.0 | 19.2.23 |
@angular/platform-server npm | From 20.0.0-next.0 | 20.3.22 |
@angular/platform-server npm | From 20.0.0-next.0 | 20.3.22 |
4 more packages
@angular/platform-server npm | From 21.0.0-next.0 | 21.2.15 |
@angular/platform-server npm | From 21.0.0-next.0 | 21.2.15 |
@angular/platform-server npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
@angular/platform-server npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
Products include Angular Angular.
How do I fix CVE-2026-50168?
Upgrade @angular/platform-server to a fixed version for your release line: 19.2.23, 20.3.22, 21.2.15 or 22.0.0-rc.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-50168 being exploited?
There is no known exploitation of CVE-2026-50168 in the wild and no public exploit code.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
- CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Sources
Also known as DEBIAN-CVE-2026-50168, GHSA-xrxm-cp7j-8xf6, UBUNTU-CVE-2026-50168.