p PatchFirst

PatchFirst · Latest vulnerabilities

@angular/router vulnerabilities

Vulnerabilities published for @angular/router in the last 30 days: 3. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-111751

    Not ratedFix available

    @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

    A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`. Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration

    @angular/router @angular/routerNode.js
    • Update to 21.2.25
    • Update to 22.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-111752

    Not ratedFix available

    @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

    A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8). During route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL. When a request URL contains multiple arbitrary empty-path outlet segments, this improper matching for

    @angular/router @angular/router @angular/router @angular/routerNode.js
    • Update to 20.3.33
    • Update to 21.2.25
    • Update to 22.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-101896

    High · CVSS 8.2EPSS 0.69%Fix available

    Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric mat

    @angular/router @angular/router @angular/router @angular/routerNode.js
    • Update to 20.3.32
    • Update to 21.2.24
    • Update to 22.2.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →