CVE-2026-50168: Angular SSR Host Allowlist Bypass Leading to SSRF

Technical summary

The vulnerability stems from a parser differential in the @angular/platform-server package. Angular's allowlist validation relies on Node.js's strict WHATWG URL parser (URL.canParse()), which correctly rejects malformed double-port URLs and skips host validation when parsing fails. However, the same malformed URL is later accepted and leniently parsed by Domino's internal URL parser during DOM initialization, which resolves the origin to a valid endpoint (http://evil.com:80). The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then uses this adopted origin to resolve relative backend HTTP requests, effectively bypassing the allowlist constraint and enabling SSRF. The attack exploits the semantic gap between two parsers operating on the same input without consistent validation.

Business impact

Organizations deploying Angular SSR applications with host allowlists to restrict backend API calls face exposure to SSRF attacks that could allow attackers to: (1) exfiltrate sensitive data from internal services not intended for external access, (2) pivot to internal network resources and systems behind the application server, (3) probe internal infrastructure and enumerate services, and (4) potentially trigger unintended state changes on internal systems. The attack requires no authentication and can be triggered remotely, making it a significant supply-chain risk for companies relying on Angular SSR for production applications.

Affected systems

The vulnerability affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. Only applications using the @angular/platform-server package with Server-Side Rendering (SSR) enabled are at risk. Applications using Angular for client-side rendering exclusively are not affected. The vulnerability is specific to Node.js SSR implementations; other server-side platforms or frameworks are not directly impacted by this Angular-specific parser differential.

Exploitability

This vulnerability has a high exploitability profile: no authentication is required, the attack is network-accessible, and the payload (a malformed double-port URL) is trivial to craft. An attacker need only make a request to the Angular SSR application with a specially formed URL parameter or request body that the application will then use as a backend request origin. The attack succeeds silently without requiring user interaction. However, practical exploitation depends on the application accepting and processing user-controlled URL inputs that are later used to construct backend requests—common in API proxies, universal rendering scenarios, and dynamic backend routing.

Remediation

Apply patches immediately: upgrade to Angular 22.0.0-rc.2 or later, 21.2.15 or later, 20.3.22 or later, or 19.2.23 or later, depending on your current version. These patches fix the parser differential by ensuring consistent URL validation before the Domino DOM parser accepts the input. Organizations should inventory all SSR deployments and prioritize patching in development, staging, and production environments. Review current host allowlist configurations to ensure they are still appropriate after patching and consider additional network-level controls to restrict backend service access.

Patch guidance

The fix is available in the specified patch versions across all supported release lines. Update your Angular dependencies via npm or yarn: `npm update @angular/platform-server` or `yarn upgrade @angular/platform-server`. Verify the installed version matches or exceeds 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23 for your respective major version line. No breaking changes are expected from these patches; they are drop-in security updates. Test in a staging environment before deploying to production, particularly if you have custom URL interceptors or allowlist logic.

Detection guidance

Monitor access logs for requests containing malformed URLs with double-port structures (e.g., http://evil.com:80:80/). Check application logs for unexpected redirects or requests to external hosts from your SSR server. If you have network-level monitoring, look for outbound connections from your Node.js SSR process to external hosts not in your allowlist. Review server access logs for patterns of probing internal services or unusual backend API calls originating from the SSR layer. A Web Application Firewall (WAF) can be configured to block requests with malformed URLs before they reach the application.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.2), direct bypass of security controls (host allowlists), and attack simplicity. SSRF vulnerabilities are consistently valuable to attackers for lateral movement and data exfiltration. The parser differential is subtle but exploitable in real-world deployments. The fact that it affects multiple Angular versions across the 19.x through 22.x lines indicates broad exposure across organizations using maintained Angular versions.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects: network-accessible attack vector, low complexity, no privilege or user interaction required, and confidentiality impact (potential data exfiltration via SSRF). The integrity impact is rated lower because SSRF typically affects availability and confidentiality more directly than integrity. The score appropriately captures the serious nature of an unauthenticated, remote allowlist bypass.

Frequently asked questions