Skip to content
fr Sign in
8.2 High

CVE-2026-111752 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Affected products and versions

Product Affected versions Fixed in
angular 22.0 22.0.0 → < 22.2.1 22.2.1
angular 21.0 21.0.0 → < 21.2.25 21.2.25
angular 20.0 20.0.0 → < 20.3.33 20.3.33
angular 19.2 earliest → 19.2.25 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of angular

The 38 CVEs of angular →
CVE-2026-111753 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) 5.9 Medium CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 8.2 High CVE-2026-111754 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 5.1 Medium CVE-2026-101896 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other… 8.2 High
Track this CVE