Platform server: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVE-2026-101895)
A denial of service (DoS) vulnerability exists in the Angular Server-Side Rendering (SSR) package @angular/platform-server due to a flaw in the domino HTML parser. When processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF, the parser enters an infinite synchronous loop that consumes 100% CPU and freezes the Node.js server process. This affects applications that bind untrusted user input to [innerHTML] or manipulate DOM on the server. The vulnerability is exploitable remotely without authentication. Workarounds include avoiding direct binding of untrusted input to [innerHTML] or sanitizing input to reject incomplete DOCTYPE strings. A patch is available for affected versions.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-101895) resides in the domino HTML parser used by @angular/platform-server for Angular SSR. Specifically, the parser's after_doctype_name_state does not advance the character pointer when encountering EOF after an incomplete DOCTYPE ending with whitespace, causing an infinite loop. This loop blocks the Node.js event loop by pegging CPU usage at 100%, resulting in a denial of service. The flaw is reachable whenever untrusted user input is rendered as HTML on the server side. The vulnerability affects multiple version ranges of @angular/platform-server and can be triggered by sending a payload such as '<!DOCTYPE html '.
Potential Impact
An unauthenticated remote attacker can cause a complete denial of service of the Node.js server process running Angular SSR by sending a specially crafted incomplete DOCTYPE string. This results in the server process locking up at full CPU utilization and becoming unresponsive to all requests, effectively causing downtime for the affected application.
Mitigation Recommendations
A fix is available for this vulnerability. Users should upgrade to patched versions of @angular/platform-server as indicated by the affected version ranges. Until patched, avoid binding untrusted user input directly to [innerHTML] in server-rendered templates. Instead, use standard text interpolation or [textContent] when raw HTML rendering is not required. Additionally, validate or sanitize user input on the server side to strip or reject strings matching /^<!DOCTYPE/i to prevent triggering the infinite loop.
Platform server: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVE-2026-101895)
Description
A denial of service (DoS) vulnerability exists in the Angular Server-Side Rendering (SSR) package @angular/platform-server due to a flaw in the domino HTML parser. When processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF, the parser enters an infinite synchronous loop that consumes 100% CPU and freezes the Node.js server process. This affects applications that bind untrusted user input to [innerHTML] or manipulate DOM on the server. The vulnerability is exploitable remotely without authentication. Workarounds include avoiding direct binding of untrusted input to [innerHTML] or sanitizing input to reject incomplete DOCTYPE strings. A patch is available for affected versions.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-101895) resides in the domino HTML parser used by @angular/platform-server for Angular SSR. Specifically, the parser's after_doctype_name_state does not advance the character pointer when encountering EOF after an incomplete DOCTYPE ending with whitespace, causing an infinite loop. This loop blocks the Node.js event loop by pegging CPU usage at 100%, resulting in a denial of service. The flaw is reachable whenever untrusted user input is rendered as HTML on the server side. The vulnerability affects multiple version ranges of @angular/platform-server and can be triggered by sending a payload such as '<!DOCTYPE html '.
Potential Impact
An unauthenticated remote attacker can cause a complete denial of service of the Node.js server process running Angular SSR by sending a specially crafted incomplete DOCTYPE string. This results in the server process locking up at full CPU utilization and becoming unresponsive to all requests, effectively causing downtime for the affected application.
Mitigation Recommendations
A fix is available for this vulnerability. Users should upgrade to patched versions of @angular/platform-server as indicated by the affected version ranges. Until patched, avoid binding untrusted user input directly to [innerHTML] in server-rendered templates. Instead, use standard text interpolation or [textContent] when raw HTML rendering is not required. Additionally, validate or sanitize user input on the server side to strip or reject strings matching /^<!DOCTYPE/i to prevent triggering the infinite loop.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f67j-2jqw-jpq7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-101895"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6abb4188f7a7c54106cc2f96
Added to database: 09/29/2026, 04:41:44 UTC
Last enriched: 09/29/2026, 04:48:14 UTC
Last updated: 09/29/2026, 10:14:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.