Threat database

CVE-2026-101896 is a high-severity vulnerability in the @angular/router URL parser affecting server-side rendering (SSR) in Node.js environments. Prior to fixed versions 20.3.32, 21.2.24, and 22.2.0, the router stores numeric matrix parameter names and numeric outlet names as properties on JavaScript objects. This can cause V8 to allocate large dense arrays, leading to excessive heap consumption. An unauthenticated attacker can exploit this by sending crafted requests with repeated numeric parameters, exhausting the Node.js heap and terminating the SSR worker. Pure client-side Angular applications are not affected. The issue is fixed in the specified versions.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.