HIGH GitHub
CVE-2026-111752
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).
During route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against eac
Affected Products
- npm/@angular/router >= 22.0.0, < 22.2.1
- npm/@angular/router >= 21.0.0, < 21.2.25
- npm/@angular/router >= 20.0.0, < 20.3.33
- npm/@angular/router <= 19.2.25
References
- https://github.com/advisories/GHSA-62vg-58rm-qff7
- https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7
- https://github.com/angular/angular/issues/70997
- https://github.com/angular/angular/pull/71055
This high severity vulnerability was published on 2026-10-20 via GitHub. Affected: npm/@angular/router >= 22.0.0, < 22.2.1, npm/@angular/router >= 21.0.0, < 21.2.25, npm/@angular/router >= 20.0.0, < 20.3.33 and 1 more.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.