Critical Memory Exhaustion Vulnerability in Angular.js Affects Server-Side Rendering
Summary
DEBIAN-CVE-2026-101896: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Affects angular.js versions 1.8.3-1 – 1.8.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular is a widely-used development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. It provides a robust framework for creating dynamic web applications. However, prior to versions 20.3.32, 21.2.24, and 22.2.0, Angular's @angular/router URL parser exhibited a significant vulnerability that could lead to memory exhaustion during server-side rendering (SSR). This issue arises from the way numeric matrix parameter names and outlet names are handled, which can result in excessive memory consumption under certain conditions.
Vulnerability Detail
The vulnerability stems from the @angular/router URL parser storing numeric matrix parameter names and outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8, the JavaScript engine, can interpret these URL-derived keys as array indices, leading to the allocation of dense backing stores sized to high numeric values. An unauthenticated attacker can exploit this by sending overlapping requests with repeated numeric matrix parameters when SSR is enabled. This can exhaust the Node.js old-space heap, ultimately terminating the SSR worker. Pure client-side Angular applications are not affected by this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling server-side rendering if it is not essential for your application. This will prevent the exploitation of the vulnerability until you can update to a patched version.
Conclusion
The vulnerability in Angular.js related to the @angular/router URL parser poses a significant risk for applications utilizing server-side rendering. It is crucial to update to the patched versions to safeguard against potential memory exhaustion attacks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for angular.js →
FAQ
Versions prior to 20.3.32, 21.2.24, and 22.2.0 are affected by this vulnerability.
No, pure client-side Angular applications are not affected by this vulnerability.
An attacker can exhaust the Node.js old-space heap, leading to the termination of the SSR worker, which can disrupt service availability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
Yes, you can temporarily disable server-side rendering until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
