Angular Router Vulnerability in Node.js Server-Side Rendering
CVE-2026-111752
What is CVE-2026-111752?
An issue exists in the Angular router for Node.js server-side rendering prior to specified versions, where crafted requests with multiple empty-path outlet groups can exploit the routing mechanism. This could enable an unauthenticated remote attacker to exhaust system resources, leading to instability in the SSR worker. The vulnerability arises from the failure to require matching auxiliary outlet URL segments against configured routes, allowing for repeated evaluations of the route configuration. The flaw presents a significant risk when SSR is enabled, and affected configurations include empty-path routes or named outlets. However, this issue does not impact client-side single-page applications or build-time prerendering.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.33 < 20.0.0, 20.3.33
angular >= 21.0.0, < 21.2.25 < 21.0.0, 21.2.25