CVE-2026-111751: @angular/router Denial of Service via RouterLink Query Parameter Retention in SSR

Background

The @angular/router package is a core component of the Angular framework, enabling developers to create single-page applications with routing capabilities. It allows for the management of navigation between different views or components in an Angular application. The package supports various features, including lazy loading, route guards, and parameterized routes. However, a vulnerability has been identified that affects its performance and stability when used in Server-Side Rendering (SSR) environments.

Vulnerability Detail

A denial of service (DoS) vulnerability exists in @angular/router when SSR is enabled on Node.js and RouterLink directives are rendered with queryParamsHandling set to 'merge' or 'preserve'. This vulnerability arises from the way RouterLink retains a computed signal that caches the UrlTree instance, leading to excessive memory consumption during concurrent requests. An attacker can exploit this by sending oversized query strings, causing the Node.js worker to exhaust its memory and crash. The vulnerability is particularly severe due to the potential for unauthenticated remote attackers to disrupt service with modest request volumes, resulting in an unrecoverable JavaScript heap out of memory error.

npm install @angular/router@22.2.3

Workaround

If immediate upgrading is not feasible, consider implementing the following workarounds:

1. Avoid using 'merge' and 'preserve' on server-rendered links. Remove defaultQueryParamsHandling: 'merge' or 'preserve' from global configuration and bind only the specific query parameters each link requires, for example: [queryParams]="{ filter: filter() }"

2. Limit query string length at the reverse proxy or middleware level. Configure your edge proxy to reject requests with excessively long query strings. For example, in your Node.js server, you can add the following middleware:

   // server.ts (before Angular SSR handler)
   app.use((req, res, next) => {
     const queryIndex = req.url.indexOf('?');
     if (queryIndex !== -1 && req.url.length - queryIndex > 2048) {
       res.status(414).send('URI Too Long');

   return;

     }

 next();

   });

3. Increase Node.js old space size by using the --max-old-space-size flag, e.g., --max-old-space-size=2048.

Conclusion

The CVE-2026-111751 vulnerability in the @angular/router package poses a significant risk to applications using Server-Side Rendering. It allows for denial of service through excessive memory consumption due to improper handling of query parameters. Immediate action is recommended to update to patched versions or implement workarounds to mitigate the risk.

See every vulnerability recorded for @angular/router →

FAQ