Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
Affects Angular SSR apps on Node.js whose route configuration has an empty-path or named-outlet route, in the listed release ranges. Fixed in 20.3.33, 21.2.25 and 22.2.1; no fix is listed for 19.2.25 and earlier.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 20.3.33, 21.2.25, 22.2.1
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 20.3.33, 21.2.25, 22.2.1.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Data gap: Advisories don't say whether default setups are affected
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.2/10CVSS 8.2
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
- Would score about 30 if advisories confirm default setups are exposed
CVE-2026-111752 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects angular; fixed in 20.3.33, 21.2.25 and 22.2.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 25/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 20.3.33, 21.2.25, 22.2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Angular's router in Node.js server-side rendering (SSR) applications is affected, allowing an unauthenticated remote attacker to send crafted requests that exhaust memory or CPU and crash the SSR worker, causing denial of service. Client-side single-page apps and build-time prerendering are not affected.
Read the original description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.
What to do
Upgrade to a fixed version: 20.3.33, 21.2.25, 22.2.1.
Workaround: Reject requests whose path contains parentheses or empty-path outlet sequences in middleware or a WAF, or limit URL length at a reverse proxy
Timeline
- CVE published
- First seen by cve.now
Affected versions
- angular angular
through 19.2.25; From 20.0.0 · fixed in 20.3.33; From 21.0.0 · fixed in 21.2.25; From 22.0.0 · fixed in 22.2.1
Evidence 10
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 10 sourcesShow fewer sources
- Repository
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-111752
Is CVE-2026-111752 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Crafted request paths can trigger unmatched empty-path outlet route matching during server-side rendering. This can exhaust a constrained worker heap and cause a denial of service.Source: github.com
Which versions are affected by CVE-2026-111752?
angular: through 19.2.25; from 20.0.0 before 20.3.33; from 21.0.0 before 21.2.25; from 22.0.0 before 22.2.1.Source: cve.now feed data
Am I affected, and how do I check?
The listed ranges are 19.2.25 and earlier, 20.0.0 before 20.3.33, 21.0.0 before 21.2.25, and 22.0.0 before 22.2.1. Exposure also requires SSR on Node.js (V8), a route configuration with an empty-path or named-outlet route, requests reaching Node.js without upstream rejection, and small worker heaps. Check the installed version with npm ls @angular/core.Source: github.com
How do I fix CVE-2026-111752?
Upgrade to 20.3.33, 21.2.25, or 22.2.1 within the matching release line. For 19.2.25 and earlier, the facts list no fixed version, so use the workaround until a fix is available.Source: github.com