Vulnerability-Lookup

CVE-2026-50168 (GCVE-0-2026-50168)

Vulnerability from cvelistv5 – Published: 2026-06-22 15:39 – Updated: 2026-06-22 17:59

Title

Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino's internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:59 UTC

CWE

CWE-346 - Origin Validation Error
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7831 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68928	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
angular	angular	Affected: >= 22.0.0-next.0, < 22.0.0-rc.2 Affected: >= 21.0.0-next.0, < 21.2.15 Affected: >= 20.0.0-next.0, < 20.3.22 Affected: >= 19.0.0-next.0, < 19.2.23 Affected: <= 18.2.14	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:59:41.275571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:59:49.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
            },
            {
              "status": "affected",
              "version": "\u003c= 18.2.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node\u0027s strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T15:47:10.871Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6"
        },
        {
          "name": "https://github.com/angular/angular/pull/68928",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68928"
        }
      ],
      "source": {
        "advisory": "GHSA-xrxm-cp7j-8xf6",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50168",
    "datePublished": "2026-06-22T15:39:46.193Z",
    "dateReserved": "2026-06-03T20:54:20.433Z",
    "dateUpdated": "2026-06-22T17:59:49.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-50168",
      "date": "2026-11-13",
      "epss": "0.00237",
      "percentile": "0.14883"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "angular",
                "vendor": "angular",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c= 18.2.14"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "939DF9D7-8867-439B-B06E-FF9D1450057D",
                    "versionEndIncluding": "18.2.14",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "9AF8FC47-F9CA-48DC-88C4-51ECA89577A7",
                    "versionEndExcluding": "19.2.23",
                    "versionStartIncluding": "19.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "6594675A-6A09-4550-AF8B-C9E25CCFE022",
                    "versionEndExcluding": "20.3.22",
                    "versionStartIncluding": "20.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C446A761-4FD9-43B8-8EF2-8A23EC2091DF",
                    "versionEndExcluding": "21.2.15",
                    "versionStartIncluding": "21.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*",
                    "matchCriteriaId": "71DA6BB7-D67B-431B-A4BB-792DEC51C980",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "01F108F8-1BC4-4E33-BB49-646C118CA697",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C5388FC5-DA5B-4C27-B868-E0D8BAD2EB28",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4A18EA1D-24C0-43F7-B73B-562F86E3A46E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*",
                    "matchCriteriaId": "B59DAA7F-A7B5-4687-96B0-10CD61165910",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*",
                    "matchCriteriaId": "19366888-B58B-4AEE-B99C-CBB26CCF9AA5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D22F98A2-DB7A-41D2-AAA0-90D8AE707267",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7D19C89E-9D61-4DBD-8CA5-5F317691E1B6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D6E69821-B1AB-4FE8-9245-74775E86D346",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*",
                    "matchCriteriaId": "E7096357-4623-475F-A015-ADB8EE2B450F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*",
                    "matchCriteriaId": "A81F04C2-2824-40B9-B7F8-B27E6DF21403",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D0002A01-F19D-47F3-94EA-C3423EC763E6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7499CFC4-AAA5-461E-909F-0E514CFD5DA1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:*",
                    "matchCriteriaId": "2A781EF8-8ADA-4960-B839-0064607D36AE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4775F816-6599-44D3-BD0F-9C843AB37DF3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node\u0027s strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
          }
        ],
        "id": "CVE-2026-50168",
        "lastModified": "2026-07-09T15:24:54.253",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-50168",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:59:41.275571Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-22T18:16:42.117",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/angular/angular/pull/68928"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              },
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-04T22:42:57+00:00",
      "cve": "CVE-2026-50168",
      "id": "CVE-2026-50168",
      "initial_release_date": "2026-06-22T15:39:46.193000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@angular/platform-server: Angular @angular/platform-server: Server-Side Request Forgery (SSRF) via malformed URL parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50168.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-50168",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-22T17:59:41.275571Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-22T17:59:45.465Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "angular",
              "vendor": "angular",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
                },
                {
                  "status": "affected",
                  "version": "\u003c= 18.2.14"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node\u0027s strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346: Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-22T15:47:10.871Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6"
            },
            {
              "name": "https://github.com/angular/angular/pull/68928",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/angular/angular/pull/68928"
            }
          ],
          "source": {
            "advisory": "GHSA-xrxm-cp7j-8xf6",
            "discovery": "UNKNOWN"
          },
          "title": "Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-50168",
        "datePublished": "2026-06-22T15:39:46.193Z",
        "dateReserved": "2026-06-03T20:54:20.433Z",
        "dateUpdated": "2026-06-22T17:59:49.283Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-50168

Vulnerability from fkie_nvd - Published: 2026-06-22 18:16 - Updated: 2026-07-09 15:24

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/angular/angular/pull/68928	Issue Tracking, Patch
	security-advisories@github.com	https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6	Vendor Advisory

Impacted products

Vendor	Product	Version
angular	angular	*
angular	angular	*
angular	angular	*
angular	angular	*
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0
angular	angular	22.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
            },
            {
              "status": "affected",
              "version": "\u003c= 18.2.14"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "939DF9D7-8867-439B-B06E-FF9D1450057D",
              "versionEndIncluding": "18.2.14",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "9AF8FC47-F9CA-48DC-88C4-51ECA89577A7",
              "versionEndExcluding": "19.2.23",
              "versionStartIncluding": "19.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "6594675A-6A09-4550-AF8B-C9E25CCFE022",
              "versionEndExcluding": "20.3.22",
              "versionStartIncluding": "20.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "C446A761-4FD9-43B8-8EF2-8A23EC2091DF",
              "versionEndExcluding": "21.2.15",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*",
              "matchCriteriaId": "71DA6BB7-D67B-431B-A4BB-792DEC51C980",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*",
              "matchCriteriaId": "01F108F8-1BC4-4E33-BB49-646C118CA697",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*",
              "matchCriteriaId": "C5388FC5-DA5B-4C27-B868-E0D8BAD2EB28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*",
              "matchCriteriaId": "4A18EA1D-24C0-43F7-B73B-562F86E3A46E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*",
              "matchCriteriaId": "B59DAA7F-A7B5-4687-96B0-10CD61165910",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*",
              "matchCriteriaId": "19366888-B58B-4AEE-B99C-CBB26CCF9AA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*",
              "matchCriteriaId": "D22F98A2-DB7A-41D2-AAA0-90D8AE707267",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*",
              "matchCriteriaId": "7D19C89E-9D61-4DBD-8CA5-5F317691E1B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*",
              "matchCriteriaId": "D6E69821-B1AB-4FE8-9245-74775E86D346",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*",
              "matchCriteriaId": "E7096357-4623-475F-A015-ADB8EE2B450F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*",
              "matchCriteriaId": "A81F04C2-2824-40B9-B7F8-B27E6DF21403",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*",
              "matchCriteriaId": "D0002A01-F19D-47F3-94EA-C3423EC763E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*",
              "matchCriteriaId": "7499CFC4-AAA5-461E-909F-0E514CFD5DA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:*",
              "matchCriteriaId": "2A781EF8-8ADA-4960-B839-0064607D36AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:*",
              "matchCriteriaId": "4775F816-6599-44D3-BD0F-9C843AB37DF3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node\u0027s strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
    }
  ],
  "id": "CVE-2026-50168",
  "lastModified": "2026-07-09T15:24:54.253",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50168",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-22T17:59:41.275571Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-22T18:16:42.117",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/angular/angular/pull/68928"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XRXM-CP7J-8XF6

Vulnerability from github – Published: 2026-06-15 16:39 – Updated: 2026-07-15 22:04

Summary

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Details

An issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM.

When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino's internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack.

Impact

Any Angular application utilizing server-side rendering (@angular/platform-server) that configures host routing allowlists (allowedHosts) is vulnerable to this allowlist bypass.

By sending an HTTP request with a malformed Host header (e.g. Host: evil.com:80:80) or an absolute-form request URI, an attacker can bypass the allowlist logic completely (even when configured with a strict default deny setup). The SSR application will then route all relative HttpClient outgoing API queries—which commonly carry sensitive credentials, session cookies, and internal authorization tokens—to the attacker-controlled server instead of the intended backend services. Additionally, the attacker can supply custom payloads back to the emulated DOM, leading to response injection and content poisoning within the rendered HTML served to users.

Attack Preconditions

To successfully exploit this vulnerability, the following environment parameters and application states must all concurrently exist:

Active Server-Side Rendering (SSR): The application must be configured to run with Angular Server-Side Rendering (@angular/platform-server).
Host Header/URI Propagation: The SSR handler must reconstruct the request URL using raw client inputs (such as request Host headers or absolute-form URIs) and pass it as config.url to the rendering API (renderApplication or renderModule).
Outbound Relative HTTP Requests: The server application must perform outbound backend API requests using relative paths (e.g., this.http.get('/api/data')) that undergo base-URL interceptor rewriting.
Enabled Allowed Hosts Check: The server must use the framework-provided allowedHosts options to limit valid server locations.

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0-next.0"
            },
            {
              "fixed": "22.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0-next.0"
            },
            {
              "fixed": "20.3.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.0.0-next.0"
            },
            {
              "fixed": "19.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "18.2.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0-next.0"
            },
            {
              "fixed": "21.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T16:39:20Z",
    "nvd_published_at": "2026-06-22T18:16:42Z",
    "severity": "HIGH"
  },
  "details": "An issue in the `@angular/platform-server` package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM.\n\nWhen a server-side request contains a malformed URL with a double port structure (e.g., `http://evil.com:80:80/path`), Node\u0027s strict `URL.canParse(url)` logic returns `false` and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to `http://evil.com:80`. The Angular SSR HTTP request interceptor (`relativeUrlsTransformerInterceptorFn`) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack.\n\n### Impact\n\nAny Angular application utilizing server-side rendering (`@angular/platform-server`) that configures host routing allowlists (`allowedHosts`) is vulnerable to this allowlist bypass. \n\nBy sending an HTTP request with a malformed Host header (e.g. `Host: evil.com:80:80`) or an absolute-form request URI, an attacker can bypass the allowlist logic completely (even when configured with a strict default deny setup). The SSR application will then route all relative `HttpClient` outgoing API queries\u2014which commonly carry sensitive credentials, session cookies, and internal authorization tokens\u2014to the attacker-controlled server instead of the intended backend services. Additionally, the attacker can supply custom payloads back to the emulated DOM, leading to response injection and content poisoning within the rendered HTML served to users.\n\n### Attack Preconditions\n\nTo successfully exploit this vulnerability, the following environment parameters and application states must all concurrently exist:\n\n1. **Active Server-Side Rendering (SSR):** The application must be configured to run with Angular Server-Side Rendering (`@angular/platform-server`).\n2. **Host Header/URI Propagation:** The SSR handler must reconstruct the request URL using raw client inputs (such as request Host headers or absolute-form URIs) and pass it as `config.url` to the rendering API (`renderApplication` or `renderModule`).\n3. **Outbound Relative HTTP Requests:** The server application must perform outbound backend API requests using relative paths (e.g., `this.http.get(\u0027/api/data\u0027)`) that undergo base-URL interceptor rewriting.\n4. **Enabled Allowed Hosts Check:** The server must use the framework-provided `allowedHosts` options to limit valid server locations.\n\n### Patches\n\n* 22.0.0-rc.2\n* 21.2.15\n* 20.3.22\n* 19.2.23",
  "id": "GHSA-xrxm-cp7j-8xf6",
  "modified": "2026-07-15T22:04:56Z",
  "published": "2026-06-15T16:39:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-xrxm-cp7j-8xf6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/68928"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass"
}

UBUNTU-CVE-2026-50168 (CVE-2026-50168)

Vulnerability from osv_ubuntu – Published: 2026-06-22 18:16 – Updated: 2026-10-17 09:44 – Source website

Details

Severity

8.8 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-50168	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-50168	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.2.28-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.2.28-1ubuntu2+esm1?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.28-1ubuntu2",
        "1.2.28-1ubuntu2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.5.10-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.5.10-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.5.10-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.7.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.7.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.7.9-1",
        "1.7.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.2-2ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.2-2",
        "1.8.2-2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-1ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-1ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-1ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3"
      ]
    }
  ],
  "aliases": [],
  "details": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. When a server-side request contains a malformed URL with a double port structure (e.g., http://evil.com:80:80/path), Node\u0027s strict URL.canParse(url) logic returns false and skips host check validation entirely. However, the same malformed URL is later accepted and parsed leniently by Domino\u0027s internal parser, which resolves the origin to http://evil.com:80. The Angular SSR HTTP request interceptor (relativeUrlsTransformerInterceptorFn) then resolves all relative backend HTTP requests against this adopted origin, executing the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.",
  "id": "UBUNTU-CVE-2026-50168",
  "modified": "2026-10-17T09:44:21Z",
  "published": "2026-06-22T18:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-50168"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50168"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-50168"
  ]
}

WID-SEC-W-2026-1930

Vulnerability from csaf_certbund - Published: 2026-06-15 22:00 - Updated: 2026-08-31 22:00

Summary

Angular: Mehrere Schwachstellen

Severity

Hoch

Scope

11 vulnerabilities in this advisory, including CVE-2026-50168.

CVE-2026-50168

Known affected: 9 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-50168 (GCVE-0-2026-50168)

FKIE_CVE-2026-50168

GHSA-XRXM-CP7J-8XF6

Impact

Attack Preconditions

Patches

UBUNTU-CVE-2026-50168 (CVE-2026-50168)

WID-SEC-W-2026-1930

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour