HIGH8.2CVE-2026-50168@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass >= 22.0.0-next.0, < 22.0.0-rc.2
MEDIUM6.1CVE-2026-50556@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR >= 22.0.0-next.0, < 22.0.0-rc.2
MEDIUM6.1CVE-2026-50555@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') >= 22.0.0-next.0, < 22.0.0-rc.2
MEDIUM6.1@angular/platform-server: SSRF via Hostname Hijacking
>= 22.0.0-next.0, < 22.0.0-next.12
MEDIUM5.3Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
>= 22.0.0-next.0, < 22.0.0-next.8
—Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
>= 16.0.0-next.0, < 18.2.14