CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...

CVE-2026-111752

The @angular/router component in Node.js server-side rendering (SSR) is vulnerable to a Denial of Service (DoS) via asymmetric resource consumption. The root cause is a failure to validate auxiliary outlet segments in the URL, allowing unconfigured empty-path outlet groups (e.g., x:/(...)) to tri...