{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111751", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-16T17:52:09.081Z", "datePublished": "2026-11-03T20:58:04.630Z", "dateUpdated": "2026-11-03T20:58:04.630Z"}, "containers": {"cna": {"title": "Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"}, {"name": "https://github.com/angular/angular/issues/70908", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/issues/70908"}, {"name": "https://github.com/angular/angular/pull/70953", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/70953"}, {"name": "https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a"}, {"name": "https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a"}, {"name": "https://github.com/angular/angular/releases/tag/v21.2.25", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/releases/tag/v21.2.25"}, {"name": "https://github.com/angular/angular/releases/tag/v22.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/releases/tag/v22.2.1"}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"version": ">= 21.2.0, < 21.2.25", "status": "affected"}, {"version": ">= 22.0.0, < 22.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T20:58:04.630Z"}, "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1."}], "source": {"advisory": "GHSA-57xq-rjx2-v5xh", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "angular", "vendor": "angular", "versions": [{"status": "affected", "version": ">= 21.2.0, < 21.2.25"}, {"status": "affected", "version": ">= 22.0.0, < 22.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1."}], "id": "CVE-2026-111751", "lastModified": "2026-11-03T21:16:57.800", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-03T21:16:57.800", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/issues/70908"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/pull/70953"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/releases/tag/v21.2.25"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/releases/tag/v22.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "@angular/router: @angular/router: Denial of Service via query parameter memory retention during server-side rendering", "id": "2566517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566517"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in @angular/router. A remote attacker can cause a Denial of Service (DoS) by sending requests with oversized query parameters to applications using Server-Side Rendering (SSR), where web pages are generated on the server. When navigation links are configured to preserve or merge query parameters, the router retains parsed request data in memory during page generation. Under concurrent request volume, this behavior exhausts available server memory and crashes the application worker process."], "name": "CVE-2026-111751", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-operator-bundle", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet5.0-build-reference-packages", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mozjs60", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-maven-repository.zip", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-sources.zip", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-11-03T20:58:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111751\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111751\nhttps://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a\nhttps://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a\nhttps://github.com/angular/angular/issues/70908\nhttps://github.com/angular/angular/pull/70953\nhttps://github.com/angular/angular/releases/tag/v21.2.25\nhttps://github.com/angular/angular/releases/tag/v22.2.1\nhttps://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"], "statement": "No Red Hat product ships an affected version. The only copies of @angular/router shipped in Red Hat products are version 7.2.6 in the Fuse 7 maven repository and sources archives, version 9.1.0 in the RHACM 2.13 volsync images, and version 15.2.9 in the Ceph dashboard builds for RHEL 8, 9, and 10 \u2014 all below the affected range. The Ceph dashboard is a client-side Angular application built with ng build and served by ceph-mgr, so Angular code never runs on a Node.js server and the vulnerable code path is not present. The remaining components flagged by dependency scanning (firefox, thunderbird, gjs, .NET build reference packages) do not ship @angular/router at all; those matches came from build-time manifest entries.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.2.0,21.2.25)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "angular", "source": "cna", "vendor": "angular"}, "product": "angular", "vendor": "angular"}], "created": "2026-11-03T23:30:06.909989+00:00", "updated": "2026-11-04T04:00:13.925089+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}