CVE-2026-111752

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

• CWE-400
• CWE-405

• https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c
• https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0
• https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79
• https://github.com/angular/angular/issues/70932
• https://github.com/angular/angular/issues/70997
• https://github.com/angular/angular/pull/71055
• https://github.com/angular/angular/releases/tag/v20.3.33
• https://github.com/angular/angular/releases/tag/v21.2.25
• https://github.com/angular/angular/releases/tag/v22.2.1
• https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111740The Post Duplicator WordPress plugin before 3.0.17 does not …2.7
• CVE-2026-111748AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111749AIOHTTP is an asynchronous HTTP client/server framework for …2.3
• CVE-2026-11175Incorrect security UI in Messages in Google Chrome on Androi…8.8
• CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111751Angular is a development platform for building mobile and de…8.2
• CVE-2026-111754Angular is a development platform for building mobile and de…5.1
• CVE-2026-111755follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111756follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111757Hono is a Web application framework that provides support fo…5.3
• CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to be…7.5
• CVE-2026-111759markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2…7.5