CVE-2026-101896High· 8.2▾ TwilightAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter nam…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 8.2
0.7%
0.7% → 0.8%
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@angular/router >= 22.0.0, < 22.2.0@angular/router >= 21.0.0, < 21.2.24@angular/router >= 20.0.0, < 20.3.32@angular/router <= 19.2.25Patched in:
@angular/router 22.2.0@angular/router 21.2.24@angular/router 20.3.32Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111751High@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
CVE-2026-111752High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
CVE-2026-101895High· 8.7Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2024-12254High· 7.5Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark"
CVE-2026-50171High@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
CVE-2026-54268High@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)