CVE-2026-111751

What it actually does

During Node.js SSR, RouterLink directives with queryParamsHandling set to merge or preserve retain attacker-controlled query parameters inside UrlTree objects for the full request lifetime, allowing oversized or repeated query strings forwarded by upstream proxies to accumulate and exhaust the V8 old-space heap until the SSR worker terminates.

Why it matters to the business

Server-side rendered Angular applications can be forced offline by a single remote request that triggers repeated heap exhaustion, causing worker restarts, degraded availability, and increased operational load until the affected versions are updated.

How an attack unfolds

An attacker sends an HTTP request containing a large query string to an SSR endpoint; upstream load balancers forward the oversized parameters without truncation; multiple RouterLink instances configured for merge or preserve each allocate a copy of the parameters inside retained UrlTree objects; repeated renders or concurrent requests drive cumulative heap growth until the Node.js process aborts the worker.

How to fix it

Upgrade Angular to version 21.2.25 or 22.2.1 (or later) in all server-side rendering packages; disable queryParamsHandling=merge or preserve on RouterLink directives until the update is applied; configure upstream proxies and load balancers to reject or truncate oversized query strings before they reach the application.

How to confirm the fix worked

Confirm the installed Angular router package version is at least 21.2.25 or 22.2.1; review application code and defaultQueryParamsHandling configuration for any remaining merge or preserve settings; test SSR rendering under high query-parameter load to verify heap usage remains bounded.

Typical attack path

1. Identify SSR endpoint using Angular RouterLink with queryParamsHandling=merge or preserve
2. Craft oversized or repeated query parameters and send via HTTP
3. Rely on upstream proxies to forward the full query string without edge rejection
4. Trigger multiple link renders or overlapping SSR requests to amplify allocation
5. Observe worker termination when old-space heap limit is reached

How to detect it

Review Node.js heap dumps and SSR worker logs for repeated UrlTree allocations correlated with large query strings; inspect access logs for requests containing unusually long or numerous query parameters hitting Angular SSR routes; correlate worker restarts with incoming traffic patterns that contain query parameters.

What your security team should do

• Immediately inventory all Angular SSR deployments and schedule upgrade to 21.2.25 or 22.2.1
• Add query-string size limits at the CDN or load-balancer layer as a temporary control
• Audit RouterLink usage for queryParamsHandling settings and replace merge/preserve where possible
• Monitor SSR worker logs and heap metrics for sudden termination events