CVE-2026-101895High· 8.7▾ MidnightPoC availableAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an inf…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
— → 8.7
Last analysed / modified upstream
0.7%
0.7% → 0.9%
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@angular/platform-server >= 22.0.0, < 22.1.6@angular/platform-server >= 21.0.0, < 21.2.23@angular/platform-server >= 20.0.0, < 20.3.31@angular/platform-server <= 19.2.25Patched in:
@angular/platform-server 22.1.6@angular/platform-server 21.2.23@angular/platform-server 20.3.31Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101896High· 8.2Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-111751High@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
CVE-2026-111754Medium@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
CVE-2026-111752High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
CVE-2022-27781High· 7.5libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a nev…
CVE-2026-88058Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages