@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-101896 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +283 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-101896 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +18 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.53 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +18 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.53 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0, <=20.3.25)

@angular/router NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

GHSA-FF3F-86QR-9CV3 Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dens...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +283 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

@angular-architects/native-federation (20.3.1), @angular-architects/native-federation-v4 (>=20.3.1, <=20.4.3) +105 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.3)

webpack-dev-middleware NPM version =7.0.0, =20.3.1, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =6.0.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =18.0.0-next.1, =18.0.0-next.1, =21.0.0-alpha.32 and more Source cves: CVE-2026-76844 Source advisory: GHSA-G84C-RXFJ-3J2C...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: OSV:GHSA-G84C-RXFJ-3J2C...

@angular-architects/native-federation (>=20.3.1, <=21.2.6), @angular-architects/native-federation-v4 (>=20.3.0, <=21.2.15) +112 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)

webpack-dev-middleware NPM version =7.0.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =1.0.0, =6.0.0, =21.2.2-depup.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =6.0.0-edsv2-beta-3 and more Source cves: CVE-2026-76844 Source advisory:...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +20 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=19.2.18, <=19.2.25)

@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 and more Source cves: CVE-2026-101895 Source advisory: OSV:GHSA-F67J-2JQW-JPQ7...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +20 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=19.2.18, <=19.2.25)

@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 and more Source cves: CVE-2026-101895 Source advisory: GHSA-F67J-2JQW-JPQ7...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: GHSA-F67J-2JQW-JPQ7...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-20255568...