CVE-2026-50168

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino's internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CWE-346
• CWE-918

• https://github.com/angular/angular/pull/68928Issue Tracking, Patch
• https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50161libre is a generic library for real-time communications with…9.3
• CVE-2026-50162oras-go is a Go library for managing OCI artifacts. Prior to…6.9
• CVE-2026-50163oras-go is a Go library for managing OCI artifacts. Prior to…7.1
• CVE-2026-50165alf.io is an open source ticket reservation system for confe…7.1
• CVE-2026-50166Kuma is a modern Envoy-based service mesh that can run on ev…5.5
• CVE-2026-50167Kurrier is a modern, self-hosted workspace for email, calend…5.3
• CVE-2026-50169Angular is a development platform for building mobile and de…6.1
• CVE-2026-5017A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-50170Angular is a development platform for building mobile and de…7.5
• CVE-2026-50171Angular is a development platform for building mobile and de…6.1
• CVE-2026-50173Flow-Like is a platform for building end-to-end use cases. P…7.2
• CVE-2026-50176The WebSocket Application Programming Interface lacks restri…8.7