Cloudanix VulnDB

CVE-2026-111752

None

CVSS

—

EPSS

1.0%

Published

Nov 3, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in certain web application setups lets attackers send specially crafted web requests that can overload and crash the server software handling page generation.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Web Framework
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unauthenticated remote requests with multiple unconfigured empty-path outlet groups trigger repeated route configuration evaluation, duplicate ActivatedRouteSnapshot tree construction, canMatch guard and resolver execution, and parameter copying, exhausting Node.js heap or CPU in SSR workers when an empty-path route or named outlet exists.

Why it matters to the business

Web applications using Angular SSR can become unavailable when workers crash under sustained crafted traffic, disrupting user access until workers are restarted or scaled.

How an attack unfolds

An unauthenticated attacker sends repeated HTTP requests containing multiple empty-path outlet groups to an SSR-enabled endpoint; the router processes each without matching configured outlets, allocating transient objects until heap or CPU limits terminate the worker.

How to fix it

Upgrade @angular/router to 20.3.33, 21.2.25, or 22.2.1; verify SSR route configurations contain no empty-path routes or named outlets reachable from untrusted input; enforce request size or rate limits at upstream proxies.

How to confirm the fix worked

Confirm installed Angular version meets or exceeds the fixed releases; replay minimal crafted requests in a test SSR environment and monitor for absence of repeated guard/resolver executions or excessive memory allocation.

Typical attack path

  1. Identify SSR endpoint accepting arbitrary URL segments
  2. Craft request containing multiple unconfigured empty-path outlet groups
  3. Send request repeatedly or in volume
  4. Observe SSR worker heap growth or CPU exhaustion leading to termination

How to detect it

Review web server and Node.js process logs for repeated requests with multiple outlet segments; correlate with SSR worker restarts, high memory or CPU spikes, and absence of authenticated sessions.

  • URL patterns containing repeated empty-path outlet segments such as (outlet:)
  • High-frequency requests to routes with named outlets from single source IPs
  • Node.js heap snapshots showing repeated ActivatedRouteSnapshot allocations

What your security team should do

  • Immediately upgrade Angular packages to the specified fixed versions
  • Audit all route configurations for empty-path routes and named outlets
  • Place rate limiting and request validation in front of SSR workers
  • Monitor SSR worker resource usage for sudden spikes

The record

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities