CVE-2026-101895: Denial of Service in @angular/platform-server Due to Infinite Loop on Malformed DOCTYPE
Summary
CVE-2026-101895: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE. Affects @angular/platform-server across 4 version ranges.
< 19.2.25
>= 20.0.0, < 20.3.31
>= 21.0.0, < 21.2.23
>= 22.0.0, < 22.1.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @angular/platform-server package is a core component of Angular's Server-Side Rendering (SSR) functionality, allowing developers to render Angular applications on the server. This package utilizes the domino library for DOM emulation and HTML parsing, enabling dynamic content generation and improved SEO. However, it is vulnerable to a Denial of Service (DoS) attack when processing untrusted user input containing malformed DOCTYPE declarations.
Vulnerability Detail
A Denial of Service (DoS) vulnerability exists in the DOM emulation parser of @angular/platform-server, specifically in the handling of incomplete DOCTYPE declarations. When the parser encounters an incomplete DOCTYPE (e.g., '<!DOCTYPE html '), it enters an infinite synchronous loop, causing the Node.js server process to consume 100% CPU and become unresponsive. This vulnerability can be exploited by an unauthenticated remote attacker, leading to service disruption for all users of the affected application.
How To Fix
Latest published version: 22.2.3 as of 22 Oct 2026
npm install @angular/platform-server@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/platform-server@19.2.25 -
>= 20.0.0, < 20.3.3120.3.31npm install @angular/platform-server@20.3.31 -
>= 21.0.0, < 21.2.2321.2.23npm install @angular/platform-server@21.2.23 -
>= 22.0.0, < 22.1.622.1.6npm install @angular/platform-server@22.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Avoid binding untrusted user input directly to [innerHTML] in server-rendered templates. Instead, use standard text interpolation ({{ userInput }}) or [textContent] when raw HTML rendering is not required. Additionally, validate or sanitize user input before passing it to [innerHTML] on the server by stripping or rejecting strings matching /^<!DOCTYPE/i.
Conclusion
The vulnerability CVE-2026-101895 in the @angular/platform-server package poses a significant risk of Denial of Service due to improper handling of malformed DOCTYPE declarations. It is crucial for developers to update to the patched versions and implement recommended workarounds to ensure the security and reliability of their applications.
See every vulnerability recorded for @angular/platform-server →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Successful exploitation of this vulnerability can lead to a Denial of Service (DoS), causing the Node.js server to freeze and become unresponsive to all requests.
Yes, you can mitigate the vulnerability by avoiding the use of [innerHTML] for untrusted user input and implementing input validation or sanitization.
Affected versions include all versions from 0.0.0 to 22.0.0, excluding the patched versions 22.1.6, 21.2.23, and 20.3.31.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/platform-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
