HIGH GitHub
CVE-2026-111751
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.
Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that
Affected Products
- npm/@angular/router >= 22.0.0, < 22.2.1
- npm/@angular/router >= 21.2.0, < 21.2.25
References
- https://github.com/advisories/GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/issues/70908
- https://github.com/angular/angular/pull/70953
This high severity vulnerability was published on 2026-10-20 via GitHub. Affected: npm/@angular/router >= 22.0.0, < 22.2.1, npm/@angular/router >= 21.2.0, < 21.2.25.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.