CVE-2026-50168: Angular Platform Server SSRF Vulnerability

CVE-2026-50168 Overview

CVE-2026-50168 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-346] in the @angular/platform-server package used for Angular server-side rendering (SSR). The flaw allows remote attackers to bypass host allowlist constraints and redirect server-side outgoing HTTP requests to arbitrary external endpoints. The root cause is a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser that initializes the server-emulated DOM. Affected releases include Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Critical Impact
Unauthenticated attackers can issue arbitrary outbound requests from Angular SSR servers, enabling internal network reconnaissance and data exfiltration through trusted server identity.

Affected Products

Angular @angular/platform-server versions prior to 19.2.23
Angular @angular/platform-server versions prior to 20.3.22 and 21.2.15
Angular @angular/platform-server versions prior to 22.0.0-rc.2

Discovery Timeline

2026-06-22 - CVE-2026-50168 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-50168

Vulnerability Analysis

The vulnerability resides in how Angular's SSR pipeline validates and resolves URLs during server-side HTTP request handling. The allowlist enforcement layer uses Node.js's strict URL.canParse(url) check, which adheres to the WHATWG URL specification. When the parser encounters a malformed URL containing a double port structure such as http://evil.com:80:80/path, URL.canParse() returns false. The Angular code interprets this as a non-URL string and skips host allowlist validation entirely.

The same string is later passed to Domino, the library that emulates the DOM on the server. Domino uses a lenient parser that accepts the malformed URL and resolves its origin to http://evil.com:80. The SSR HTTP interceptor relativeUrlsTransformerInterceptorFn then treats this origin as the base for all relative backend HTTP requests issued during rendering. The result is a controlled SSRF where outbound traffic targets an attacker-chosen host.

Root Cause

The defect is a classic parser differential [CWE-346], an Origin Validation Error. Two URL parsers in the same request path apply different acceptance rules to the same input. The strict parser short-circuits validation, while the lenient parser binds the input to the request origin used during rendering.

Attack Vector

The attacker supplies a malformed URL with a double port segment through any input channel that reaches the SSR rendering context, such as request headers, query parameters, or routing inputs consumed during render. Angular skips host validation, Domino accepts the URL, and the SSR interceptor resolves subsequent relative HTTP calls against the attacker-controlled origin. No authentication or user interaction is required.

The vulnerability is described in prose because no verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-xrxm-cp7j-8xf6 for the maintainer's technical write-up.

Detection Methods for CVE-2026-50168

Indicators of Compromise

Outbound HTTP requests from Angular SSR Node.js processes to hosts not present in the configured allowlist.
Server logs containing URLs with double port structures such as http://host.example:80:80/.
Unexpected DNS resolutions originating from SSR worker processes for attacker-controlled domains.

Detection Strategies

Inspect ingress traffic for URL parameters, headers, or routing inputs containing multiple colon-separated port segments.
Correlate SSR process egress traffic against the documented host allowlist and flag deviations.
Audit dependency manifests (package.json, package-lock.json) for vulnerable @angular/platform-server versions.

Monitoring Recommendations

Enable egress filtering on Angular SSR hosts and alert on connections to non-allowlisted destinations.
Forward Node.js application logs to a centralized analytics platform and apply queries for malformed URL patterns.
Track outbound DNS queries from SSR containers and alert on first-seen domains.

How to Mitigate CVE-2026-50168

Immediate Actions Required

Upgrade @angular/platform-server to 19.2.23, 20.3.22, 21.2.15, or 22.0.0-rc.2 as appropriate for your major version.
Inventory all Node.js services running Angular SSR and confirm patched versions are deployed.
Apply network-layer egress restrictions on SSR hosts to limit outbound traffic to required destinations.

Patch Information

The Angular team fixed the parser differential in the patches referenced by the GitHub Pull Request 68928. The fix harmonizes URL parsing so that allowlist validation rejects inputs that Domino would later accept. Patched versions are 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Workarounds

Add a web application firewall (WAF) rule blocking request inputs containing the regex pattern :\d+:\d+ in URL fields.
Restrict the SSR process to an egress proxy that enforces the allowlist independently of the application layer.
Disable or constrain user-controlled inputs that feed into SSR-rendered HTTP calls until patches are applied.

bash

# Configuration example - upgrade vulnerable Angular packages
npm install @angular/platform-server@21.2.15 --save
npm audit
npm ls @angular/platform-server