Description
A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling.
Starting in v21.2.
Recommendation
Update the @angular/router package to the latest compatible version. Followings are version details:
Affected version(s): **>= 21.2.0, < 21.2.25 >= 22.0.0, < 22.2.1** Patched version(s): **21.2.25 22.2.1**
References
Could your website be exposed too?
SmartScanner can check your website for @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) - CVE-2026-111752
- Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters - CVE-2026-101896
- jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - CVE-2026-25535
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026