@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Description

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8).

During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name.

Recommendation

Update the @angular/router package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 19.2.25

  >= 20.0.0, < 20.3.33

  >= 21.0.0, < 21.2.25

  >= 22.0.0, < 22.2.1**

• Patched version(s): **20.3.33

  21.2.25

  22.2.1**

References

• GHSA-62vg-58rm-qff7
• CVE-2026-111752
• CWE-400
• CWE-405
• CAPEC-310