CVE-2026-111751— Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

Quick assessment

Affected

angular angular

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Angular 是一个用于使用 TypeScript/JavaScript 及其他语言构建移动和桌面 Web 应用的开发平台。在版本 21.2.0 至 21.2.25 以及 22.2.1 中，在 Node.js 服务端渲染（SSR）期间渲染的指令会将计算出的实例保留至当前请求的生命周期结束。当配置为或（无论是针对单个链接还是通过全局设置）时，每个已渲染的链接都可能在自身的中保留一份由攻击者控制的查询参数副本。如果上游代理或负载均衡器未能在边缘层拒绝超大查询字符串，而是将其原样转发，则多个受影响的链接

CVSS 8.2 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

Source: CVE Program / CVE List V5

Vulnerability Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
angular	angular	>= 21.2.0, < 21.2.25	-

II. Public POCs for CVE-2026-111751

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111751

请登录查看更多情报信息。

Other References for CVE-2026-111751 (7)

https://github.com/angular/angular/pull/70953 x_refsource_MISC
https://github.com/angular/angular/issues/70908 x_refsource_MISC
https://github.com/angular/angular/releases/tag/v22.2.1 x_refsource_MISC
https://github.com/angular/angular/releases/tag/v21.2.25 x_refsource_MISC
https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh x_refsource_CONFIRM
https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a x_refsource_MISC
https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-111751

Same Patch Batch · angular · 2026-11-03 · 3 CVEs total

CVE-2026-111752	8.2 HIGH	Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side R
CVE-2026-111754	5.1 MEDIUM	Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

IV. Related Vulnerabilities

Same product: angular

Same vendor: angular

Same weakness: CWE-400