CVE-2026-111751 Angular CVE debrief

Who should care

Defenders responsible for systems using `@angular/router` with SSR enabled should assess exposure and verify potential impact. This includes reviewing the number of affected links and the size of parsed query parameter maps, and prioritizing the application of fixes to prevent potential DoS attacks.

Why it matters

Defenders should prioritize assessing exposure and verifying potential impact, focusing on systems using `@angular/router` with SSR enabled, due to the potential for denial of service via excessive memory consumption.

• Potential for denial of service due to excessive memory consumption.
• Need for verification of affected versions and exposure.
• Priority for applying the fix to prevent potential DoS attacks.
• Importance of monitoring for potential DoS attacks and implementing compensating controls.

Technical summary

The vulnerability is caused by the caching of `UrlTree` instances in the heap during SSR, leading to multiplicative memory consumption. The issue was introduced in version 21.2.0 and fixed in version 22.2.1. This results in a denial of service (DoS) vulnerability when `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`. Defenders should prioritize assessing exposure and verifying potential impact, focusing on systems using `@angular/router` with SSR enabled, due to the potential for denial of service via excessive memory consumption.

Defensive priority

Defenders should prioritize assessing exposure and verifying potential impact, focusing on systems using `@angular/router` with SSR enabled.

Recommended defensive actions

• Assess exposure by identifying systems using `@angular/router` with SSR enabled.
• Verify potential impact by reviewing the number of affected links and the size of parsed query parameter maps.
• Apply the fix by updating to version 22.2.1 or later.
• Monitor for potential DoS attacks and implement compensating controls as needed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the caching of `UrlTree` instances in the heap during SSR, leading to multiplicative memory consumption. The issue was introduced in version 21.2.0 and fixed in version 22.2.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.