Memory Consumption Vulnerability in Angular's @angular/router for Node.js Server-Side Rendering
CVE-2026-101896
8.2HIGH
What is CVE-2026-101896?
The @angular/router component in Angular allows unauthenticated attackers to exploit Node.js server-side rendering by sending overlapping requests with repeated numeric matrix parameters. This can lead to an excessive allocation of memory, resulting in the exhaustion of the Node.js old-space heap and potentially terminating the SSR worker. This vulnerability affects versions of @angular/router prior to the updates in 20.3.32, 21.2.24, and 22.2.0, though pure client-side applications remain unaffected.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.32 < 20.0.0, 20.3.32
angular >= 21.0.0, < 21.2.24 < 21.0.0, 21.2.24