By crafting URLs with repeated numeric matrix parameters (e.g., /a;990;2522), an attacker achieves a memory amplification factor of approximately 350x. This allows an unauthenticated remote attacker to trigger a fatal JavaScript heap out of memory error in the SSR worker with relatively low concurrency. This vulnerability is specific to SSR implementations and does not affect pure client-side Single Page Applications (SPAs).

Attack Chain

1. Attacker identifies a target application utilizing Angular SSR with Node.js.
2. Attacker probes the endpoint to confirm the handling of URL matrix parameters (semicolons in path segments).
3. Attacker crafts a long request path containing multiple segments, each featuring repeated numeric matrix parameters (e.g., ;990;2522).
4. Attacker sends multiple concurrent HTTP requests to the SSR endpoint, utilizing standard web-server buffer capacities (e.g., 2 KB to 8 KB path lengths).
5. The @angular/router component parses the URL, populating a parameters object with the malicious numeric keys.
6. V8 engine interprets these keys as dense array indices and allocates large, contiguous HOLEY_ELEMENTS backing stores for each segment.
7. Heap memory consumption spikes rapidly due to the 350x memory amplification.
8. Node.js process reaches the configured heap limit, triggering a process crash and resulting in a Denial of Service.

Impact

Successful exploitation results in the termination of the SSR worker process, causing a service outage for users relying on server-side rendered content. An attacker can force this state with as few as 12 to 22 concurrent requests if the path length is near 8 KB, or 50 to 100 requests for smaller paths, effectively rendering the application unavailable.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade @angular/router to version 22.2.0, 21.2.24, 20.3.32, or later to address CVE-2026-101896.
• Configure upstream reverse proxies (Nginx, WAF) to block or strip semicolons (;) from incoming request URIs to prevent malicious parameters from reaching the Angular router.
• Implement strict request path segment limits at the edge to reduce the maximum possible heap allocation per request.
• Monitor SSR worker process memory usage via monitoring tools; sudden spikes in heap memory accompanied by high frequencies of semicolon-containing URLs indicate potential exploitation attempts.