Denial of service in Angular SSR via RouterLink query parameters
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Angular from 21.2.0 before 21.2.25 and from 22.0.0 before 22.2.1 is affected. With merge or preserve query parameter handling, RouterLink directives rendered during Node.js server-side rendering keep attacker-controlled query parameters in their URL trees for each request (CWE-400). An unauthenticated remote attacker who sends oversized query strings can exhaust the Node.js heap and crash the SSR worker.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular | 21.2.0 to before 21.2.25; 22.0.0 to before 22.2.1 | 21.2.25, 22.2.1 | Patch available | CNA |
| — | @angular/router (npm) | 22.0.0 to before 22.2.1 | 22.2.1 | Patch available | GHSA-57xq-rjx2-v5xh |
| — | @angular/router (npm) | 21.2.0 to before 21.2.25 | 21.2.25 | Patch available | GHSA-57xq-rjx2-v5xh |
- angular Vendorangular Affected 21.2.0 to before 21.2.25; 22.0.0 to before 22.2.1 Fixed in 21.2.25, 22.2.1 Patch available CNA
- @angular/router (npm) Vendor— Affected 22.0.0 to before 22.2.1 Fixed in 22.2.1 Patch available GHSA-57xq-rjx2-v5xh
- @angular/router (npm) Vendor— Affected 21.2.0 to before 21.2.25 Fixed in 21.2.25 Patch available GHSA-57xq-rjx2-v5xh
Remediation
Upgrade angular to 21.2.25 or 22.2.1, matching the release line in use. The @angular/router npm package is fixed in the same versions, 21.2.25 and 22.2.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA angular (angular) Fixed in 21.2.25, 22.2.1
- Fix · GHSA-57xq-rjx2-v5xh @angular/router (npm) Fixed in 22.2.1 Advisory →
- Fix · GHSA-57xq-rjx2-v5xh @angular/router (npm) Fixed in 21.2.25 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 6 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
Timeline
- 2026-11-03 Threatist record created from CVE-2026-111751
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: LOW → MEDIUM
References
Other 9
- https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/issues/70908
- https://github.com/angular/angular/pull/70953
- https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a
- https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a
- https://github.com/angular/angular/releases/tag/v21.2.25
- https://github.com/angular/angular/releases/tag/v22.2.1
- https://github.com/angular/angular/commit/319a3c4f3268f4f96ac4acdbb118737d2261e0be
- https://github.com/angular/angular
More angular vulnerabilities
- TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
- TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
- TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
- TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-111751 · CVE Program
- CVE-2026-111751 · NVD
- FIRST EPSS
- CVE-2026-111751 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences