Infinite Loop Vulnerability in Angular Platform Server by Google
CVE-2026-101895
8.7HIGH
What is CVE-2026-101895?
The Angular platform-server has a vulnerability that allows for the potential abuse of server-side rendering functionalities. An attacker can exploit this flaw by injecting specially crafted HTML with an incomplete DOCTYPE, which causes the DOM emulation parser to enter an infinite synchronous loop. This exploitation can lead to significant CPU consumption on Node.js server-side rendering workers, effectively starving the event loop and preventing the processing of concurrent or subsequent requests. The issue has been resolved in Angular versions 20.3.31, 21.2.23, and 22.1.6.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.31 < 20.0.0, 20.3.31
angular >= 21.0.0, < 21.2.23 < 21.0.0, 21.2.23