@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) (CVE-2026-111752)
Description
A denial of service (DoS) vulnerability exists in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js. The router fails to validate auxiliary outlet segments in URLs, allowing crafted requests with multiple empty-path outlet segments to cause excessive memory and CPU usage. This leads to Node.js process termination due to heap exhaustion. The vulnerability affects SSR configurations with empty-path or named outlet routes and can be mitigated by upgrading to patched versions or rejecting malicious URL patterns upstream.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in @angular/router occurs during route recognition in SSR mode on Node.js. The router does not properly validate whether auxiliary outlet segments in the URL correspond to configured routes for those outlets. Unconfigured empty-path outlet groups are not rejected, causing the router to repeatedly re-evaluate route configurations, instantiate duplicate ActivatedRouteSnapshot trees, and execute canMatch guards and resolvers multiple times. This behavior allows an unauthenticated remote attacker to send crafted URLs with multiple empty-path outlet segments to exhaust the Node.js heap or overwhelm CPU resources, resulting in SSR worker termination. The issue is fixed in versions 22.2.1, 21.2.25, and 20.3.33 by requiring child outlet segments to match configured routes before processing. Workarounds include rejecting URLs containing parentheses or empty-path outlet sequences in middleware or WAF before Angular SSR handles the request.
Potential Impact
Successful exploitation causes Node.js SSR worker processes to crash due to JavaScript heap out-of-memory errors, resulting in denial of service. Memory exhaustion is transient and occurs during route recognition, with no persistent memory leak. Repeated execution of guards and resolvers can increase backend load and hold connections open. Client-side Angular applications and build-time prerendering are not affected. The vulnerability requires SSR enabled on Node.js with specific route configurations and acceptance of crafted URLs upstream.
Mitigation Recommendations
A fix is available in @angular/router versions 22.2.1, 21.2.25, and 20.3.33. Upgrading to these versions or later is the recommended remediation. If immediate upgrade is not possible, mitigate by rejecting requests containing parentheses or empty-path outlet URL patterns (e.g., ':/( ', '(/ ', '///( ') in middleware or WAF before they reach Angular SSR. This blocks heap exhaustion and guard/resolver amplification attacks. No other actions are required if patched versions are deployed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-62vg-58rm-qff7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-111752"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6ad7914c2cdf04f656405af6
Added to database: 10/20/2026, 16:05:32 UTC
Last enriched: 10/20/2026, 16:18:25 UTC
Last updated: 10/20/2026, 16:18:25 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.