CVE-2026-111752

A flaw was found in @angular/router. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending crafted HTTP requests containing multiple unconfigured outlet URL segments to an application using Server-Side Rendering (SSR). Due to improper route validation, the router repeatedly evaluates route configurations and excessively consumes memory and CPU resources, causing the server worker process to crash.

A flaw was found in @angular/router. Prior to versions 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak; client-side SPAs and build-time prerendering are not affected. This issue is fixed in @angular/router 20.3.33, 21.2.25, and 22.2.1.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.