Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
Affects Angular 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0 when SSR runs on Node.js and RouterLink uses queryParamsHandling 'merge' or 'preserve'. Fixed in 21.2.25 and 22.2.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 21.2.25, 22.2.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Node.js server-side rendering (SSR) enabled, running on Node.js (V8) RouterLink elements rendered during SSR use queryParamsHandling 'merge' or 'preserve', per link or via defaultQueryParamsHandling Reverse proxies or load balancers forward long query strings to the application rather than rejecting them at the edge Multiple concurrent requests must be processed simultaneously in the same Node.js worker instance
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.2/10CVSS 8.2
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
CVE-2026-111751 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects angular; fixed in 21.2.25 and 22.2.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 21.2.25, 22.2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Angular's RouterLink directive, used in server-side rendered (Node.js) Angular applications from versions 21.2.0 through 21.2.24 and 22.2.0, can be abused by sending oversized query strings, causing the server to run out of memory and crash the SSR worker, resulting in denial of service. Pure client-side single-page applications are not affected.
Read the original description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.
What to do
Check whether your setup matches what the bug needs.
Node.js server-side rendering (SSR) enabled, running on Node.js (V8) RouterLink elements rendered during SSR use queryParamsHandling 'merge' or 'preserve', per link or via defaultQueryParamsHandling Reverse proxies or load balancers forward long query strings to the application rather than rejecting them at the edge Multiple concurrent requests must be processed simultaneously in the same Node.js worker instanceUpgrade to a fixed version: 21.2.25, 22.2.1.
Workaround: Remove defaultQueryParamsHandling 'merge' or 'preserve' from global configuration; limit query string length at reverse proxy or middleware; increase Node.js old space.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- angular angular
From 21.2.0 · fixed in 21.2.25; From 22.0.0 · fixed in 22.2.1
Evidence 7
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-111751
Is CVE-2026-111751 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When SSR renders RouterLink elements that keep existing query parameters, very long query strings can exhaust the Node.js old-space heap. Under concurrent requests on the same worker, the SSR worker then crashes with a fatal out-of-memory error.Source: github.com
Which versions are affected by CVE-2026-111751?
angular: from 21.2.0 before 21.2.25; from 22.0.0 before 22.2.1.Source: cve.now feed data
Am I affected, and how do I check?
Versions 21.2.0 up to 21.2.25 and 22.0.0 up to 22.2.1 are affected. The setup must use Node.js SSR and RouterLink with queryParamsHandling 'merge' or 'preserve', either per link or through defaultQueryParamsHandling, behind a proxy that forwards long query strings. Check the @angular/core version in package.json, then search templates for queryParamsHandling and the app configuration for defaultQueryParamsHandling.Source: github.com
How do I fix CVE-2026-111751?
Upgrade to Angular 21.2.25 if you are on the 21.2 line, or to 22.2.1 if you are on the 22 line. Until then, follow the workaround guidance for your setup.Source: github.com