CVE-2026-111751

A flaw was found in @angular/router. A remote attacker can cause a Denial of Service (DoS) by sending requests with oversized query parameters to applications using Server-Side Rendering (SSR), where web pages are generated on the server. When navigation links are configured to preserve or merge query parameters, the router retains parsed request data in memory during page generation. Under concurrent request volume, this behavior exhausts available server memory and crashes the application worker process.

No Red Hat product ships an affected version. The only copies of @angular/router shipped in Red Hat products are version 7.2.6 in the Fuse 7 maven repository and sources archives, version 9.1.0 in the RHACM 2.13 volsync images, and version 15.2.9 in the Ceph dashboard builds for RHEL 8, 9, and 10 — all below the affected range. The Ceph dashboard is a client-side Angular application built with ng build and served by ceph-mgr, so Angular code never runs on a Node.js server and the vulnerable code path is not present. The remaining components flagged by dependency scanning (firefox, thunderbird, gjs, .NET build reference packages) do not ship @angular/router at all; those matches came from build-time manifest entries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.