CVE-2026-111752

Red Hat products that ship @angular/router (the Ceph dashboard, Red Hat Advanced Cluster Management volsync, and Fuse 7 UI artifacts) bundle it only inside client-side single-page applications that execute in the user's browser. Exploitation of this flaw requires Angular Server-Side Rendering (SSR) on Node.js, which none of these products use; client-side Angular applications are not vulnerable. All affected Red Hat products have therefore been assessed as NOTAFFECTED and no update is required.

For custom applications built on @angular/router with SSR enabled on Node.js, the following mitigations apply:

1. Update to a patched version: @angular/router 22.2.1, 21.2.25, or 20.3.33. Versions below v20 are affected but are no longer supported upstream and will not receive a fix.
2. If updating is not immediately possible, reject crafted outlet-segment URLs before they reach the Angular SSR handler:
   - If the application does not use named (auxiliary) outlets in URLs, reject any request whose path contains "(" or ")".
   - If named outlets are used, reject request paths containing empty-path outlet sequences: ":/(", "(/", or "///(".
3. Limit the full request-target length (not only the query string) at the reverse proxy or WAF, for example to 2048 bytes. Note that guard/resolver amplification is possible with short URLs, so URL length limits alone are not sufficient.
4. Increasing the Node.js --max-old-space-size raises the request size and concurrency needed to exhaust the worker heap, reducing but not eliminating the risk.

--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to reject incoming HTTP requests containing auxiliary outlet syntax before reaching the Angular Server-Side Rendering handler: upgrade to @angular/router 20.3.33, 21.2.25, or 22.2.1, which invokes processSegment directly within processChildren to enforce child outlet name alignment with route configuration and ensure no unconsumed segment groups remain, closing all 2 injection vectors (crafted URLs containing unconfigured empty-path outlet groups, auxiliary outlet URL sequences piercing empty-path routes). Until patched, this is only a concern on applications using Angular Server-Side Rendering (SSR) on Node.js — client-side single-page applications and build-time prerendering are unaffected — so reject request paths containing parentheses or empty-path outlet sequences like ':/(', '(/', or '///(' at the reverse proxy or WAF, and enforce request-target length limits. As a compensating measure, detect terminated or unresponsive Node.js SSR processes and automatically restart them using service watchdogs and automatic restart policies, enforce upper bounds on URL length and path segment counts to restrict repeated outlet groups, and limit the rate of incoming requests per client IP to slow down worker memory and CPU exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper route outlet matching defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-904 WAF (Web Application Firewall) (high)