Description
A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8).
When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects (Record<string, string>).
Recommendation
Update the @angular/router package to the latest compatible version. Followings are version details:
Affected version(s): **<= 19.2.25 >= 20.0.0, < 20.3.32 >= 21.0.0, < 21.2.24 >= 22.0.0, < 22.2.0** Patched version(s): **20.3.32 21.2.24 22.2.0**
References
Could your website be exposed too?
SmartScanner can check your website for Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) - CVE-2026-111751
- @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) - CVE-2026-111752
- jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - CVE-2026-25535
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026