@trellisorg/preload-chunks (1.0.1) potentially affected by CVE-2026-101895 via @angular/platform-server (15.2.7)

@angular/platform-server NPM version 15.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @trellisorg/preload-chunks 1.0.1 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@proactive-as/angular.vendor (7.2.13), @sitespirit/mediaspirit-module (>=0.0.71, <=7.2.17) +3 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=7.2.4, <=7.2.15)

@angular/platform-server NPM version =7.2.4, =0.0.71, =0.0.2, =0.0.1-1.1, =2.0.11, =2.1.499 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@mxtommy/kip (>=1.1.1, <=1.1.2), calendarevents.app (>=0.0.0, <=0.0.1) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=9.1.7, <=9.1.11)

@angular/platform-server NPM version =9.1.7, =1.1.1, =0.0.0, =0.0.1 - shared-encoding-library 0.0.0 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-101895 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

CVE-2026-101895

The @angular/platform-server DOM emulation parser is vulnerable to an infinite synchronous loop when processing attacker-controlled HTML containing an incomplete DOCTYPE ending with whitespace. This occurs in Domino lib/HTMLParser.js because the after_doctype_name_state emits tokens without advan...

CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-101895: Uncontrolled Resource Consumption

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

Security Bulletin: Vulnerabilities reported in platform-server-19.2.22.tgz are addressed in APIM11.1

Summary Vulnerabilities reported in platform-server-19.2.22.tgz are addressed in APIM11.1 Vulnerability Details CVEID:CVE-2026-69149 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27,...

WS-2026-0105

@angular/platform-server 17.0.0-rc.1 before 20.3.33, 21.2.25 and 22.2.1: ServerPlatformLocation rejects protocol-relative URLs before WHATWG URL normalization, so a path such as /.//evil.test normalizes to //evil.test and Angular SSR emits it in a Location header, an open redirect. Lines 17-19 ar...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by unknown CVE via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: unknown CVE Source advisory: MEND:WS-2026-0105...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by unknown CVE via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: unknown CVE Source advisory: MEND:WS-2026-0105...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=19.2.18, <=19.2.25)

@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 - mat-typeahead-library-custom123 0.0.0 and more Source cves: CVE-2026-101895 Source advisory: OSV:GHSA-F67J-2JQW-JPQ7...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-101895 Source advisory: OSV:GHSA-F67J-2JQW-JPQ7...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-101895 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-20255568...

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-20255568...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: GHSA-F67J-2JQW-JPQ7...