Angular Router: Denial of Service via numeric matrix parameters in SSR
Summary
The Angular router package (@angular/router) can be made to consume excessive memory while parsing URLs during server-side rendering (SSR) on Node.js. An unauthenticated attacker can send overlapping requests with repeated numeric matrix parameters, which exhausts the Node.js heap and terminates the SSR worker. Pure client-side Angular applications are not affected. The CVSS 4.0 base score is 8.2 (High) and the impact is limited to availability.
Affected
- @angular/router up to and including 19.2.25 (no fixed 19.x release known)
- @angular/router >= 20.0.0, < 20.3.32
- @angular/router >= 21.0.0, < 21.2.24
- @angular/router >= 22.0.0, < 22.2.0
Only applications with SSR enabled on Node.js are affected.
Fixed in
- 20.3.32
- 21.2.24
- 22.2.0
A fixed 19.x release is unknown. Check the vendor advisory for Angular 19.
Workaround
- Block or strip semicolons in request paths at the reverse proxy or WAF before traffic reaches the Angular SSR service. Test first, because legitimate matrix parameters may break.
- Disable SSR for the affected application if patching is not possible.
Exploitation
- No exploitation in the wild known at the time of writing.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof of concept found in the sources reviewed.
Our recommendation
- Check whether any Angular application uses SSR on Node.js (for example via @angular/ssr) and is exposed to the internet.
- Update @angular/router to 20.3.32, 21.2.24 or 22.2.0, or the latest patch release of these lines.
- For Angular 19 and older, obtain the vendor guidance and apply a proxy filter in the meantime.
- Monitor SSR worker restarts and memory usage for signs of attacks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ff3f-86qr-9cv3 github.com
- GitHub Advisory Database GHSA-ff3f-86qr-9cv3 github.com
- Angular 20.3.32 release github.com
- Angular 21.2.24 release github.com
- Angular 22.2.0 release github.com
- Fix commit 03872a80 (angular/angular) github.com
- OSV CVE-2026-101896 osv.dev
- GitLab Advisory Database CVE-2026-101896 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:25.
Original description (NVD)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
NVD references (9)
- https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583
- https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d
- https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4
- https://github.com/angular/angular/issues/70716
- https://github.com/angular/angular/pull/70717
- https://github.com/angular/angular/releases/tag/v20.3.32
- https://github.com/angular/angular/releases/tag/v21.2.24
- https://github.com/angular/angular/releases/tag/v22.2.0
- https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.