# @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Malformed double-port URLs bypass Angular SSR allowedHosts validation via WHATWG/Domino parser differential, redirecting relative HttpClient calls to attacker servers.

- Payout: Research
- Severity: high
- Program: Angular
- Found by: 0xEr3n
- Disclosed: 2026-06-15
- CVE: CVE-2026-50168
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-xrxm-cp7j-8xf6
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-xrxm-cp7j-8xf6
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:nodejs technique:parser-differential vuln:access-control vuln:host-header vuln:ssrf

**Target:** @angular/platform-server SSR host allowlist / relativeUrlsTransformerInterceptorFn
**Root cause:** Allowlist validation uses strict WHATWG URL.canParse which rejects malformed double-port URLs, while Domino's lenient parser later accepts the same URL and adopts its origin for relative request resolution.
**Steps:**
1. Configure Angular SSR app with allowedHosts and relative HttpClient calls like `this.http.get('/api/data')`.
2. Send request with malformed Host header `Host: evil.com:80:80` or absolute-form URI `http://evil.com:80:80/path`.
3. URL.canParse returns false, host check is skipped entirely.
4. Domino parses the URL leniently, resolving origin to `http://evil.com:80`.
5. relativeUrlsTransformerInterceptorFn rewrites relative backend requests against attacker origin, exfiltrating credentials/cookies.
**How found:** Reporter noticed a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino parser used to initialize the emulated DOM, then tested malformed double-port URLs that fail strict parsing but succeed in Domino.
**Exploitation:** Attacker sends a request with a malformed double-port Host header or absolute-form URI; the allowlist check is skipped, Domino adopts the attacker origin, and all relative HttpClient backend calls (carrying cookies/tokens) are routed to the attacker server. Attacker can also inject payloads into the emulated DOM for response poisoning.
**Escalation:** Beyond SSRF, attacker-supplied payloads reach the emulated DOM, enabling response injection and content poisoning in rendered HTML.
**Insight:** When an allowlist check and the actual URL consumer use different parsers, hunt for inputs the strict parser rejects (skipping validation) but the lenient parser accepts—double ports, malformed authorities, and absolute-form URIs are prime candidates.