Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Priority MEDIUM 44CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino's internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed angular (angular): 22.0.0-rc.2, 21.2.15, 20.3.22 +1@angular/platform-server (npm): 22.0.0-rc.2, 20.3.22, 19.2.23 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular | 22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.15; 20.0.0-next.0 to before 20.3.22; 19.0.0-next.0 to before 19.2.23; up to 18.2.14 | 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23 | Patch available | CNA |
| — | @angular/platform-server (npm) | 22.0.0-next.0 to before 22.0.0-rc.2 | 22.0.0-rc.2 | Patch available | GHSA-xrxm-cp7j-8xf6 |
| — | @angular/platform-server (npm) | 20.0.0-next.0 to before 20.3.22 | 20.3.22 | Patch available | GHSA-xrxm-cp7j-8xf6 |
| — | @angular/platform-server (npm) | 19.0.0-next.0 to before 19.2.23 | 19.2.23 | Patch available | GHSA-xrxm-cp7j-8xf6 |
| — | @angular/platform-server (npm) | up to 18.2.14 | — | No fix listed | GHSA-xrxm-cp7j-8xf6 |
| — | @angular/platform-server (npm) | 21.0.0-next.0 to before 21.2.15 | 21.2.15 | Patch available | GHSA-xrxm-cp7j-8xf6 |
- angular Vendorangular Affected 22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.15; 20.0.0-next.0 to before 20.3.22; 19.0.0-next.0 to before 19.2.23; up to 18.2.14 Fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23 Patch available CNA
- @angular/platform-server (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-rc.2 Fixed in 22.0.0-rc.2 Patch available GHSA-xrxm-cp7j-8xf6
- @angular/platform-server (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.22 Fixed in 20.3.22 Patch available GHSA-xrxm-cp7j-8xf6
- @angular/platform-server (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.23 Fixed in 19.2.23 Patch available GHSA-xrxm-cp7j-8xf6
- @angular/platform-server (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-xrxm-cp7j-8xf6
- @angular/platform-server (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.15 Fixed in 21.2.15 Patch available GHSA-xrxm-cp7j-8xf6
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | 2.0.0 – 18.2.14; 19.0.0 to before 19.2.23; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* | 22.0.0 next0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* | 22.0.0 next1 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* | 22.0.0 next10 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* | 22.0.0 next11 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* | 22.0.0 next12 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* | 22.0.0 next2 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* | 22.0.0 next3 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* | 22.0.0 next4 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* | 22.0.0 next5 | Vulnerable | angular |
- cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions 2.0.0 – 18.2.14; 19.0.0 to before 19.2.23; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* Versions 22.0.0 next0 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* Versions 22.0.0 next1 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* Versions 22.0.0 next10 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* Versions 22.0.0 next11 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* Versions 22.0.0 next12 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* Versions 22.0.0 next2 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* Versions 22.0.0 next3 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* Versions 22.0.0 next4 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* Versions 22.0.0 next5 Vulnerable ·angular
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* | 22.0.0 next6 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* | 22.0.0 next7 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* | 22.0.0 next8 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* | 22.0.0 next9 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* | 22.0.0 rc0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* | 22.0.0 rc1 | Vulnerable | angular |
- cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* Versions 22.0.0 next6 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* Versions 22.0.0 next7 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* Versions 22.0.0 next8 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* Versions 22.0.0 next9 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* Versions 22.0.0 rc0 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* Versions 22.0.0 rc1 Vulnerable ·angular
Remediation
- Fix · CNA angular (angular) Fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, 19.2.23
- Fix · GHSA-xrxm-cp7j-8xf6 @angular/platform-server (npm) Fixed in 22.0.0-rc.2 Advisory →
- Fix · GHSA-xrxm-cp7j-8xf6 @angular/platform-server (npm) Fixed in 20.3.22 Advisory →
- Fix · GHSA-xrxm-cp7j-8xf6 @angular/platform-server (npm) Fixed in 19.2.23 Advisory →
- Fix · GHSA-xrxm-cp7j-8xf6 @angular/platform-server (npm) Fixed in 21.2.15 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50168
- 2026-10-03 Alias added: GHSA-xrxm-cp7j-8xf6
References
More Angular vulnerabilities
- TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
- TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
- TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
- TI-2026-48469 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning CVSS 4.0HIGH 8.8
Sources
- CVE-2026-50168 · CVE Program
- CVE-2026-50168 · NVD
- FIRST EPSS
- GHSA-xrxm-cp7j-8xf6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-50168 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences