CVE-2026-111751

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.

• CWE-400
• CWE-770

• https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a
• https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a
• https://github.com/angular/angular/issues/70908
• https://github.com/angular/angular/pull/70953
• https://github.com/angular/angular/releases/tag/v21.2.25
• https://github.com/angular/angular/releases/tag/v22.2.1
• https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11174Inappropriate implementation in Site Isolation in Google Chr…5.3
• CVE-2026-111740The Post Duplicator WordPress plugin before 3.0.17 does not …2.7
• CVE-2026-111748AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111749AIOHTTP is an asynchronous HTTP client/server framework for …2.3
• CVE-2026-11175Incorrect security UI in Messages in Google Chrome on Androi…8.8
• CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111752Angular is a development platform for building mobile and de…8.2
• CVE-2026-111754Angular is a development platform for building mobile and de…5.1
• CVE-2026-111755follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111756follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111757Hono is a Web application framework that provides support fo…5.3
• CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to be…7.5