@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0, <=20.3.25)

@angular/router NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +18 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.53 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-101896 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +18 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.53 and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +283 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

GHSA-FF3F-86QR-9CV3 Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-101896 via @angular/router (>=20.0.0-rc.0, <=20.3.25)

@angular/router NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-101896 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-101896 Source advisory: OSV:GHSA-FF3F-86QR-9CV3...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +18 more potentially affected by CVE-2026-101896 via @angular/router (>=22.0.0, <=22.1.8)

@angular/router NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =22.0.0-alpha.1, =22.0.0-alpha.1, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.53 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +283 more potentially affected by CVE-2026-101896 via @angular/router (>=19.0.0-next.9, <=19.2.25)

@angular/router NPM version =19.0.0-next.9, =3.19.0, =0.0.327, =19.0.0, =3.0.0, =1.0.0, =0.1.1, =5.0.559-alpha, =5.1.670-alpha and more Source cves: CVE-2026-101896 Source advisory: GHSA-FF3F-86QR-9CV3...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +36 more potentially affected by CVE-2026-101896 via @angular/router (>=21.0.0, <=21.2.22)

@angular/router NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-next.10, =21.0.0-next.10, =3.0.1, =6.0.1, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-101896 Source advisory: SNYK:JS-ANGULARROUTER-20361514...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dens...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using...

EUVD-2026-89481

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

PT-2026-103631

Name of the Vulnerable Software and Affected Versions simple-php-router versions prior to 5.4.1.8 Description The IpRestrictAccess middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the X-Forwarded-For,...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

CVE-2026-103592: Use of Less Trusted Source

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

AlmaLinux 9.2 [TuxCare] Security Update: radvd (ALMALINUX9.2:CLSA-2026:1783420753)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783420753 advisory. - radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer...