@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +32 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0, <=20.3.25)

@angular/router NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

GHSA-FF3F-86QR-9CV3 Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +32 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0-rc.0, <=20.3.25)

@angular/router NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +280 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +32 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0, <=20.3.25)

@angular/router NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +280 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dens...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +19 more potentially affected by unknown CVE via @angular/router (>=22.0.0, <=22.2.0)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.59 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0104...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +32 more potentially affected by unknown CVE via @angular/router (>=20.0.0-rc.0, <=20.3.25)

@angular/router NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0104...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +384 more potentially affected by CVE-2021-4231 via @angular/router (>=4.0.0, <=4.4.6)

@angular/router NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =2.8.2, =3.0.0-beta.45, =1.32.0-SNAPSHOT.20171018190510, =0.0.64, =1.10.0, =2.0.0-rc.2, =1.10.1, =2.0.0-beta.8, =1.0.1, =0.2.83, =0.2.1, =0.3.4 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@afelio/sprb-osiris-uikit (1.0.48), @alfresco/adf-content-services (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4) +200 more potentially affected by CVE-2021-4231 via @angular/router (>=5.0.0, <=5.2.10)

@angular/router NPM version =5.0.0, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.2, =1.0.0-beta.1, =1.0.0-alpha.55, =0.1.6, =3.0.0, =0.0.54,...

@altariotechnologieslisbon/seed-pro (>=0.0.1, <=0.1.0), @bi8/am-data-table (>=8.0.0, <=8.0.2) +461 more potentially affected by CVE-2021-4231 via @angular/router (>=8.0.0, <=8.2.13)

@angular/router NPM version =8.0.0, =0.0.1, =8.0.0, =8.0.0, =1.0.0, =1005.9.0, =1.0.6, =0.2.5, =0.6.8 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@abt-desk/apm (>=0.0.1, <=0.33.12), @abt-desk/rsc (>=0.1.3, <=0.1.124) +443 more potentially affected by CVE-2021-4231 via @angular/router (>=7.0.0, <=7.2.14)

@angular/router NPM version =7.0.0, =0.0.1, =0.1.3, =2.0.0, =9.25.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.2.2 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@arsedizioni/ars-utils (>=1.0.0, <=1.0.3), @astick/astick-ng (1.0.0) +271 more potentially affected by CVE-2021-4231 via @angular/router (>=9.0.0, <=9.1.12)

@angular/router NPM version =9.0.0, =1.0.0, =3.0.0, =0.0.1, =0.0.3, =0.0.1, =5.1.4, =1.0.0, =1.0.1 - @esfaenza/ngx-charts 9.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @bi8/am-data-table (>=6.0.1, <=6.0.2) +176 more potentially affected by CVE-2021-4231 via @angular/router (>=6.0.0, <=6.1.9)

@angular/router NPM version =6.0.0, =1.0.0, =6.0.1, =6.0.0, =9.16.1-rc.0, =1.1.0, =5.0.0-beta.1, =0.0.5, =2.0.0, =2.0.1 - @golden-codes/core 2.0.0 - @hackages/ngxerrors 6.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...