Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101896— Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

Quick assessment

Affected
angular angular
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Angular 是一个用于使用 TypeScript/JavaScript 及其他语言构建移动和桌面端 Web 应用的开发平台。在版本 20.3.32、21.2.24 和 22.2.0 之前，@angular/router 的 URL 解析器在 Node.js 服务端渲染（SSR）过程中，会将数值类型的矩阵参数名称和数值型出口（outlet）名称存储为初始为空 JavaScript 对象的属性。V8 引擎会将这些由 URL 导出的键解释为数组索引，并为高数值分配密集的后备存储，导致每个重复的小路径段造成不成比例的堆

CVSS 8.2 · High EPSS 0.69% · P52

Affected Version Matrix 8

VendorProduct Version RangeStatus
@angular router <= 19.2.25 affected
>= 20.0.0, < 20.3.32 affected
>= 21.0.0, < 21.2.24 affected
>= 22.0.0, < 22.2.0 affected
angular angular <= 19.2.25 affected
>= 20.0.0, < 20.3.32 affected
>= 21.0.0, < 21.2.24 affected
>= 22.0.0, < 22.2.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101896

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Source: CVE Program / CVE List V5
Vulnerability Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
angular angular <= 19.2.25 -
@angular router <= 19.2.25 -

II. Public POCs for CVE-2026-101896

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101896

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-101896 (4)

Other References for CVE-2026-101896 (5)

Same Patch Batch · angular · 2026-10-14 · 3 CVEs total

CVE-2026-101895 8.7 HIGH Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
CVE-2026-101897 5.1 MEDIUM Angular DevTools (Local DoS)

IV. Related Vulnerabilities

Same product: angular
Same vendor: angular
Same weakness: CWE-400

V. Comments for CVE-2026-101896

No comments yet

Leave a comment