CVE-2026-50168

A flaw was found in the @angular/platform-server package of Angular. This vulnerability allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser. By sending a malformed URL with a double port structure, an attacker can cause the server to skip host validation and resolve the origin to a malicious external endpoint, leading to a Server-Side Request Forgery (SSRF) attack.

Important: A Server-Side Request Forgery (SSRF) flaw exists in Angular's @angular/platform-server package, allowing remote attackers to bypass host allowlist restrictions. This vulnerability, present in applications utilizing server-side rendering with host routing allowlists, enables the redirection of internal API requests to arbitrary external endpoints, potentially leading to information disclosure or content manipulation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.