@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

CVE-2026-111751

A denial of service DoS vulnerability was identified in "@angular/router" when Server-Side Rendering SSR is enabled on Node.js V8 and "RouterLink" directives are rendered with "queryParamsHandling: 'merge'" or "'preserve'", configured either per link or globally via "defaultQueryParamsHandling"...