Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111752— Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Quick assessment

Affected
angular angular
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Angular 是一个用于使用 TypeScript/JavaScript 及其他语言构建移动和桌面 Web 应用的开发平台。在版本 20.3.33、21.2.25 和 22.2.1 之前，@angular/router 在 Node.js 服务端渲染（SSR）环境中未能强制要求辅助路由出口（auxiliary outlet）的 URL 片段与其配置的出口名称相匹配。精心构造的请求若包含多个未配置的“空路径”出口组，可反复触发路由配置评估，构建重复的 ActivatedRouteSnapshot 树，执行 canM

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111752

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
Source: CVE Program / CVE List V5
Vulnerability Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
angular angular <= 19.2.25 -

II. Public POCs for CVE-2026-111752

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111752

请登录查看更多情报信息。

Other References for CVE-2026-111752 (10)

Same Patch Batch · angular · 2026-11-03 · 3 CVEs total

CVE-2026-111751 8.2 HIGH Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Renderi
CVE-2026-111754 5.1 MEDIUM Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

IV. Related Vulnerabilities

Same product: angular
Same vendor: angular
Same weakness: CWE-400