CVE-2026-1117528.2HighCWE-405

CVE-2026-111752: Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

angular

Affected: angular · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

63rd percentile

050100

Higher than 63% of scored CVEs

8.2HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

angular · angular<= 19.2.25; >= 20.0.0, < 20.3.33; >= 21.0.0, < 21.2.25; >= 22.0.0, < 22.2.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Asymmetric Resource Consumption (Amplification) · Denial of Service
Vendor: angular
Published: November 2026
Band: Unlikely (under 1%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-111752 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.