CVE-2026-101896

8.2High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-770

Impact

Remote, unauthenticated attackers can crash Node.js SSR worker processes by causing heap exhaustion. They only need network access to send specially crafted HTTP requests with repeated numeric matrix parameters to SSR-enabled endpoints.

Root cause

The @angular/router URL parser stores numeric matrix parameter and outlet names directly as object properties during SSR, causing V8 to allocate dense backing arrays sized to large numeric index values and exhaust process memory.

Affected systems

Angular versions prior to 20.3.32, 21.2.24, and 22.2.0 (only when using server-side rendering).

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade @angular/router and related Angular dependencies to 20.3.32, 21.2.24, or 22.2.0. If patching immediately is not possible, block or sanitize request URLs containing semicolons or large numeric matrix parameters at the reverse proxy or WAF layer.

shell

$ npm update @angular/router

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-101896