CVE-2026-111751

@angular/router: @angular/router: Denial of Service via query parameter memory retention during server-side rendering

@angular/router

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled…

3. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-111751