Angular platform-server: Denial of service via infinite loop in DOCTYPE parsing
Summary
The DOM emulation parser in @angular/platform-server, which relies on the domino library, can enter an infinite synchronous loop when it processes HTML with an incomplete DOCTYPE that ends with whitespace at the end of input. A remote, unauthenticated attacker can trigger this through server-side HTML parsing paths such as innerHTML bindings, consuming a Node.js SSR worker at full CPU and blocking concurrent and subsequent requests. Only Angular applications using server-side rendering that process attacker-controlled HTML are affected.
Affected
- Angular 19.2.25 and earlier (no fix available in the 19.x line)
- Angular 20.0.0 to before 20.3.31
- Angular 21.0.0 to before 21.2.23
- Angular 22.0.0 to before 22.1.6
- Affected package: @angular/platform-server
Fixed in
- 20.3.31
- 21.2.23
- 22.1.6
Workaround
- Do not bind untrusted user input directly to [innerHTML] in server-rendered templates; use text interpolation or [textContent] where raw HTML rendering is not required.
- Unknown: no further vendor-documented workaround.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- Not listed in CISA KEV as far as known; no evidence of exploitation in the wild found.
- Public proof of concept: unknown.
Our recommendation
- Identify all @angular/platform-server dependencies in lockfiles and deployed images, including transitive ones.
- Upgrade to 20.3.31, 21.2.23 or 22.1.6 (or a later release in these lines).
- Angular 19 and older have no fix: plan a migration or consider extended support.
- Until patched, stop binding untrusted HTML to [innerHTML] on the server side.
- Monitor SSR processes for high CPU usage and unresponsiveness.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f67j-2jqw-jpq7 github.com
- Angular release v20.3.31 github.com
- Angular release v21.2.23 github.com
- Angular release v22.1.6 github.com
- Angular commit 3db26e2 (domino update) github.com
- Domino commit 4d97473 (fix) github.com
- GitLab advisory for @angular/platform-server advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:05.
Original description (NVD)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
NVD references (8)
- https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25
- https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567
- https://github.com/angular/angular/releases/tag/v20.3.31
- https://github.com/angular/angular/releases/tag/v21.2.23
- https://github.com/angular/angular/releases/tag/v22.1.6
- https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7
- https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f
- https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.