Memory Consumption Issue in Angular RouterLink Directives Affecting Server-Side Rendering
CVE-2026-111751
What is CVE-2026-111751?
Angular, a popular development platform for mobile and desktop applications, contains a vulnerability in its RouterLink directives that can lead to excessive memory consumption during Node.js server-side rendering. When certain query parameters handling modes are activated, the directives can retain copies of attacker-controlled query parameters, increasing memory allocation pressure. This is particularly problematic when used with upstream proxies or load balancers that fail to properly restrict oversized query strings. As multiple affected links are rendered, memory can rapidly accumulate, potentially exhausting the Node.js old-space heap and leading to a termination of the SSR worker. Users of affected Angular versions should update to versions 21.2.25 or 22.2.1 to mitigate this issue.
Affected Version(s)
angular >= 21.2.0, < 21.2.25 < 21.2.0, 21.2.25
angular >= 22.0.0, < 22.2.1 < 22.0.0, 22.2.1