CVE-2026-111752

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

CVE-2026-101896

A flaw was found in @angular/router. When Server-Side Rendering SSR is enabled, the URL parser allocates disproportionate amounts of memory when handling numeric matrix parameters. An unauthenticated remote attacker can exploit this vulnerability by sending HTTP requests containing repeated numer...

CVE-2026-111752

A flaw was found in @angular/router. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted HTTP requests containing multiple unconfigured outlet URL segments to an application using Server-Side Rendering SSR. Due to improper route validation, the router repeatedl...

CVE-2026-111751

A flaw was found in @angular/router. A remote attacker can cause a Denial of Service DoS by sending requests with oversized query parameters to applications using Server-Side Rendering SSR, where web pages are generated on the server. When navigation links are configured to preserve or merge quer...

CVE-2026-111752

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.29), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-111751 via @angular/router (>=22.0.0, <=22.2.0)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-111751 Source advisory: MEND:CVE-2026-111751...

@augustalabs/ki-assistent (>=1.0.8, <=1.0.14), @bitblit/ngx-acute-common (>=6.1.196-alpha, <=6.1.209-alpha) +17 more potentially affected by CVE-2026-111751 via @angular/router (>=21.2.0, <=21.2.22)

@angular/router NPM version =21.2.0, =1.0.8, =6.1.196-alpha, =6.1.196-alpha, =0.1.0, =21.2.0-snapshot-1772819386488, =21.2.0-snapshot-1772819386488, =6.0.1, =2.0.1, =0.19.0, =14.0.0, =0.107.1, =0.107.1, =0.5.1, =0.5.11 and more Source cves: CVE-2026-111751 Source advisory: MEND:CVE-2026-111751...

CVE-2026-111751

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.29), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-111752 via @angular/router (>=22.0.0, <=22.2.0)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-111752 Source advisory: MEND:CVE-2026-111752...

CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

CVE-2026-111752

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-111752 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-111752 Source advisory: MEND:CVE-2026-111752...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-111752 via @angular/router (>=20.0.0, <=20.3.25)

@angular/router NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-111752 Source advisory: MEND:CVE-2026-111752...

CVE-2026-111752

The @angular/router component in Node.js server-side rendering (SSR) is vulnerable to a Denial of Service (DoS) via asymmetric resource consumption. The root cause is a failure to validate auxiliary outlet segments in the URL, allowing unconfigured empty-path outlet groups (e.g., x:/(...)) to tri...

Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Angular router and fast-uri libraries.

Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Angular router @angular/router is vulnerable to an improper neutralization of input during web generation vulnerability no CVE assigned. ID: WS-2026-0104; fast-uri is vulnerable to multiple...

Security Bulletin: IBM ApplinX is vulnerable to Improper Validation of Specified Quanitity in Input issue due to the use of source-map-js and @angular/router (CVE-2026-93749).

Summary A security vulnerability in source-map-js a transitive dependency via sass and @angular/router affects IBM ApplinX CVE-2026-93749. These packages are used in the ApplinX web framework front-end. IBM has issued fixes to resolve this vulnerability. The source-map-js version has been updated...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the RouterLink directive's urlTree computed signal, which permanently caches a UrlTree instance including its cloned query parameter map and segment tree in ReactiveNode.value for...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.29), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-111751 via @angular/router (>=22.0.0, <=22.2.0)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-111751 Source advisory: OSV:GHSA-57XQ-RJX2-V5XH...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.29), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-111751 via @angular/router (>=22.0.0, <=22.2.0)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-111751 Source advisory: SNYK:JS-ANGULARROUTER-21280763...