Multiple security vulnerabilities have been identified in the Angular router package, affecting version 21.1 and enabling denial of service in server-side rendering deployments. Both flaws allow unauthenticated remote attackers to exhaust server memory or processing resources by sending crafted requests. The affected component is the router used when server-side rendering is enabled, and successful exploitation can terminate rendering workers and disrupt service availability.
CVE-2026-111752 (CVSS 8.2 — High): The router fails to validate auxiliary outlet segments during server-side rendering route matching, allowing unconfigured empty-path outlet groups to trigger repeated route evaluation. An unauthenticated remote attacker can send crafted request paths to exhaust memory or CPU resources and terminate the rendering worker.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Angular router package, affecting version 21.1 and enabling denial of service in server-side rendering deployments. Both flaws allow unauthenticated remote attackers to exhaust server memory or processing resources by sending crafted requests. The affected component is the router used when server-side rendering is enabled, and successful exploitation can terminate rendering workers and disrupt service availability.
CVE-2026-111752 (CVSS 8.2 — High): The router fails to validate auxiliary outlet segments during server-side rendering route matching, allowing unconfigured empty-path outlet groups to trigger repeated route evaluation. An unauthenticated remote attacker can send crafted request paths to exhaust memory or CPU resources and terminate the rendering worker.[emaillocker id="1283"]
CVE-2026-111751 (CVSS 8.2 — High): The router's link directives can retain parsed query parameter data for the duration of a request when merge or preserve query parameter behavior is used during server-side rendering. An unauthenticated remote attacker can issue concurrent requests with large query strings to amplify memory consumption and exhaust the rendering worker.
These vulnerabilities collectively present a high denial-of-service risk for applications that expose server-side rendering to untrusted traffic, especially when server memory is constrained. Operators of such services should assess exposure and monitor for abnormal request patterns that could indicate exploitation.
We recommend you to update @angular/router to version 22.2.1, 21.2.25, or 20.3.33 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]