CVE-2026-101896: @angular/router Denial of Service via Numeric URL Matrix Parameters
Summary
CVE-2026-101896: Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters. Affects @angular/router across 4 version ranges.
< 19.2.25
>= 20.0.0, < 20.3.32
>= 21.0.0, < 21.2.24
>= 22.0.0, < 22.2.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/router package is a core component of the Angular framework, facilitating navigation and routing in Angular applications. It enables developers to define routes, manage navigation states, and handle URL parameters effectively. However, when Server-Side Rendering (SSR) is enabled, it becomes susceptible to specific vulnerabilities that can lead to denial of service attacks.
Vulnerability Detail
A denial of service (DoS) vulnerability exists in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). The vulnerability arises when numeric strings are used as matrix parameter names or outlet names in incoming request URLs. This causes the V8 JavaScript engine to allocate excessive memory due to its internal property-storage heuristics, leading to potential heap exhaustion. An attacker can exploit this by crafting URLs with repeated numeric matrix parameters, resulting in significant memory amplification and ultimately crashing the SSR worker with a 'JavaScript heap out of memory' error.
How To Fix
Latest published version: 22.2.3 as of 22 Oct 2026
npm install @angular/router@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/router@19.2.25 -
>= 20.0.0, < 20.3.3220.3.32npm install @angular/router@20.3.32 -
>= 21.0.0, < 21.2.2421.2.24npm install @angular/router@21.2.24 -
>= 22.0.0, < 22.2.022.2.0npm install @angular/router@22.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workaround in your reverse proxy configuration to block or sanitize matrix parameters:
# Nginx example: reject requests containing matrix parameters
if ($uri ~* ";") {
return 400;
}
Conclusion
The vulnerability CVE-2026-101896 in @angular/router poses a significant risk for applications utilizing Server-Side Rendering. It is crucial to apply the necessary patches or implement workarounds to mitigate the risk of denial of service attacks.
See every vulnerability recorded for @angular/router →
FAQ
Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap, leading to a denial of service.
Applications using @angular/router with SSR enabled and without proper filtering of matrix parameters are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
Matrix parameters are a way to pass additional data in URLs, typically formatted as key-value pairs separated by semicolons, e.g., /path;key=value.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/router.
