CVE-2026-101896
Description
A flaw was found in @angular/router. When Server-Side Rendering (SSR) is enabled, the URL parser allocates disproportionate amounts of memory when handling numeric matrix parameters. An unauthenticated remote attacker can exploit this vulnerability by sending HTTP requests containing repeated numeric path parameters to exhaust server memory. This issue can crash the rendering process, resulting in a Denial of Service (DoS).
Statement
This IMPORTANT severity denial of service flaw affects the upstream @angular/router npm package when Angular Server-Side Rendering (SSR) is enabled on Node.js. When @angular/router parses a request URL, numeric matrix parameter names and numeric outlet names are stored as properties on initially empty JavaScript objects; the V8 JavaScript engine interprets these URL-derived keys as array indices and allocates dense backing stores sized to high numeric values, so a small path segment causes disproportionate heap consumption. An unauthenticated remote attacker can send overlapping HTTP requests containing repeated numeric matrix parameters to exhaust the Node.js old-space heap and terminate the SSR worker process with a fatal out-of-memory error. Exploitation requires SSR to be enabled, user-controlled request URLs to be parsed directly by the router, and upstream reverse proxies to forward URLs containing semicolons and multiple path segments without filtering; pure client-side Angular applications are not affected. No Red Hat product is currently recorded as affected by this flaw. The upstream CVSS v4 score (8.2) is higher than the Red Hat CVSS v3.1 score (7.5); both reflect an availability-only denial of service, and the difference stems from CVSS version and metric differences, with the upstream v4 attack-requirements metric accounting for the SSR and proxy preconditions.
Mitigation
Exploitation requires requests containing semicolons and multiple path segments to reach the Angular SSR service, so the issue can be mitigated at the edge or reverse proxy until the package is updated:
- Configure the reverse proxy or WAF (for example Nginx, Cloudflare, or AWS WAF) to reject or strip semicolons in request paths before forwarding requests to the Angular SSR service. A Nginx example: if ($uri ~* ";") { return 400; }
- Enforce strict path segment limits and reject requests with excessive path depth (for example, more than 20 to 30 segments).
- Increasing the Node.js old-space heap size (--max-old-space-size) raises the number of concurrent requests needed to exhaust memory, but does not eliminate the vulnerability under sustained traffic.
Upstream fixed this issue in @angular/router 22.2.0, 21.2.24, and 20.3.32, so updating to a fixed version is the complete remediation. Upstream versions at or below 19.2.25 are end of support and will not be patched.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
