DEBIAN-CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

EUVD-2026-101126

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

@landsoft/wng-auth-module (>=1.0.0, <=1.0.4), anb-forms (>=1.2.0, <=1.3.0) +11 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=5.2.0, <=5.2.10)

@angular/platform-server NPM version =5.2.0, =1.0.0, =1.2.0, =1.2.1, =3.0.0, =5.0.1, =1.0.6, =0.0.57, =0.0.1, =0.0.0, =0.0.11 - wng-id-components 1.0.2 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@hmcts/annotation-ui (1.0.0), @hmcts/annotation-ui-lib (>=1.0.1, <=1.0.2-RC) +10 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=6.1.0, <=6.1.9)

@angular/platform-server NPM version =6.1.0, =1.0.1, =1.1.8-bata.1, =2.0.0, =1.23.14, =1.0.634, =1.0.635 - shivs-angular5-painter 1.1.0 - totvs-thf2-components 0.0.2 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@proactive-as/angular.vendor (7.2.13), @sitespirit/mediaspirit-module (>=0.0.71, <=7.2.17) +3 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=7.2.4, <=7.2.15)

@angular/platform-server NPM version =7.2.4, =0.0.71, =0.0.2, =0.0.1-1.1, =2.0.11, =2.1.499 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

angular-store-locator (>=0.0.1, <=0.1.0), angular5-canvas-drawer (1.6.5) +2 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=8.2.0, <=8.2.12)

@angular/platform-server NPM version =8.2.0, =0.0.1, =1.0.135, =2.0.20 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@mxtommy/kip (>=1.1.1, <=1.1.2), calendarevents.app (>=0.0.0, <=0.0.1) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=9.1.7, <=9.1.11)

@angular/platform-server NPM version =9.1.7, =1.1.1, =0.0.0, =0.0.1 - shared-encoding-library 0.0.0 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@nk-spirit/nk-ngx-bootstrap (7.1.16) potentially affected by CVE-2026-101895 via @angular/platform-server (11.2.0)

@angular/platform-server NPM version 11.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @nk-spirit/nk-ngx-bootstrap 7.1.16 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@flowaccount/scullyio (1.0.0), @flowaccount/scullyio-scully (>=2.0.0, <=2.0.14) +21 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=12.2.6, <=12.2.15)

@angular/platform-server NPM version =12.2.6, =2.0.0, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.41 and more Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@trellisorg/preload-chunks (1.0.1) potentially affected by CVE-2026-101895 via @angular/platform-server (15.2.7)

@angular/platform-server NPM version 15.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @trellisorg/preload-chunks 1.0.1 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-101895 via @angular/platform-server (18.2.13)

@angular/platform-server NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-101895 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

CVE-2026-101895

The @angular/platform-server DOM emulation parser is vulnerable to an infinite synchronous loop when processing attacker-controlled HTML containing an incomplete DOCTYPE ending with whitespace. This occurs in Domino lib/HTMLParser.js because the after_doctype_name_state emits tokens without advan...

CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...