Threats tagged 'ghsa-f67j-2jqw-jpq7'

A denial of service (DoS) vulnerability exists in the Angular Server-Side Rendering (SSR) package @angular/platform-server due to a flaw in the domino HTML parser. When processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF, the parser enters an infinite synchronous loop that consumes 100% CPU and freezes the Node.js server process. This affects applications that bind untrusted user input to [innerHTML] or manipulate DOM on the server. The vulnerability is exploitable remotely without authentication. Workarounds include avoiding direct binding of untrusted input to [innerHTML] or sanitizing input to reject incomplete DOCTYPE strings. A patch is available for affected versions.