{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/angular-@angular/router--22.0.0--22.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:google:angular:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-111751"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Angular (@angular/router \u003e= 22.0.0 \u003c 22.2.1)","Angular (@angular/router \u003e= 21.2.0 \u003c 21.2.25)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","angular","nodejs","ssr"],"_cs_type":"advisory","_cs_vendors":["Google"],"content_html":"\u003cp\u003eA denial of service (DoS) vulnerability exists in \u003ccode\u003e@angular/router\u003c/code\u003e when Server-Side Rendering (SSR) is enabled on Node.js (V8) and \u003ccode\u003eRouterLink\u003c/code\u003e directives use \u003ccode\u003equeryParamsHandling\u003c/code\u003e set to \u003ccode\u003e'merge'\u003c/code\u003e or \u003ccode\u003e'preserve'\u003c/code\u003e. Introduced in version 21.2.0, a refactor to signals caused the \u003ccode\u003eRouterLink\u003c/code\u003e directive to persistently cache \u003ccode\u003eUrlTree\u003c/code\u003e instances in the heap for the duration of the request.\u003c/p\u003e\n\u003cp\u003eIn applications using \u003ccode\u003e'merge'\u003c/code\u003e or \u003ccode\u003e'preserve'\u003c/code\u003e configurations, every rendered link copies incoming request query parameters into its own \u003ccode\u003eUrlTree\u003c/code\u003e. Because SSR maintains active \u003ccode\u003eRouterLink\u003c/code\u003e instances while awaiting asynchronous data or page rendering, an attacker can supply large, dense query parameter payloads to force multiplicative heap consumption. This amplification causes the Node.js old-space heap to reach its limit, triggering a fatal out-of-memory crash. The vulnerability affects \u003ccode\u003e@angular/router\u003c/code\u003e versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a public-facing Angular application utilizing Server-Side Rendering (SSR).\u003c/li\u003e\n\u003cli\u003eAttacker confirms the application supports \u003ccode\u003equeryParamsHandling\u003c/code\u003e logic (e.g., merging/preserving parameters into navigation links).\u003c/li\u003e\n\u003cli\u003eAttacker crafts multiple concurrent HTTP requests containing large query strings with high-density parameters (e.g., thousands of numeric keys).\u003c/li\u003e\n\u003cli\u003eNode.js SSR worker receives concurrent requests, initiating the Angular rendering lifecycle for each.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRouterLink\u003c/code\u003e directive's refactored signal caching logic pins individual \u003ccode\u003eUrlTree\u003c/code\u003e objects containing the attacker's bloated query maps to the heap.\u003c/li\u003e\n\u003cli\u003eMemory usage grows multiplicatively per request as the SSR worker processes route dependencies and waits for async operations.\u003c/li\u003e\n\u003cli\u003eNode.js old-space heap capacity is exhausted, causing the SSR worker process to terminate due to an unrecoverable \u0026quot;out of memory\u0026quot; fatal error.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability for the targeted SSR application. By saturating the heap with concurrent requests, an attacker can force continuous restarts or process termination of the Node.js runtime, effectively denying service to legitimate users. The impact is significant for high-traffic environments where SSR is a core component of the user experience. Pure client-side Angular applications (SPAs) are unaffected as the memory pressure remains confined to individual client browsers rather than the server-side process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@angular/router\u003c/code\u003e to version \u003ccode\u003e22.2.1\u003c/code\u003e or \u003ccode\u003e21.2.25\u003c/code\u003e immediately to address the memory retention issue documented in CVE-2026-111751.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, configure edge infrastructure (e.g., Nginx, WAF, or AWS ALB) to reject incoming HTTP requests with query strings exceeding 2,048 bytes to mitigate the amplification factor.\u003c/li\u003e\n\u003cli\u003eImplement a server-side middleware check to validate the length of \u003ccode\u003ereq.url\u003c/code\u003e before passing the request to the Angular SSR handler.\u003c/li\u003e\n\u003cli\u003eAudit application route configurations to remove global \u003ccode\u003edefaultQueryParamsHandling: 'merge'\u003c/code\u003e or \u003ccode\u003e'preserve'\u003c/code\u003e settings; explicitly specify only necessary parameters on \u003ccode\u003eRouterLink\u003c/code\u003e elements to minimize heap exposure.\u003c/li\u003e\n\u003cli\u003eIncrease the \u003ccode\u003e--max-old-space-size\u003c/code\u003e Node.js flag as a short-term buffer, though note this does not provide complete protection against sustained, high-volume exploitation attempts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T23:56:07Z","date_published":"2026-10-20T23:56:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-angular-router-dos/","summary":"A memory exhaustion vulnerability in @angular/router during server-side rendering allows remote, unauthenticated attackers to crash Node.js SSR workers by sending concurrent requests with dense, oversized query strings.","title":"Angular: Denial of service via RouterLink query parameter retention (CVE-2026-111751)","url":"https://feed.craftedsignal.io/briefs/2026-10-angular-router-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Angular (@Angular/Router \u003e= 22.0.0 \u003c 22.2.1)","version":"https://jsonfeed.org/version/1.1"}