Angular Router SSR Flaw Crashes Node.js Workers via Query Parameter Amplification

A high-severity denial-of-service vulnerability in the Angular Router package allows unauthenticated attackers to crash Node.js servers. Security researchers identified that the flaw arises during server-side rendering when specific query parameter handling configurations are in use.

What happened

According to GitHub advisory GHSA-57xq-rjx2-v5xh, the vulnerability stems from changes introduced in Angular Router version 21.2.0. Developers refactored RouterLink internals to use signals, creating a computed signal that cached UrlTree instances. This change caused each rendered link to retain its associated query parameter dictionary in the heap for the entire request lifecycle.

The issue occurs specifically when RouterLink directives are rendered with queryParamsHandling set to merge or preserve. This configuration can be applied per link or globally via defaultQueryParamsHandling. When these settings are active, each link copies the incoming request's query parameters into its own UrlTree object during server-side rendering.

Memory consumption scales multiplicatively based on the number of affected links and the size of the parsed query parameter map. Parsed JavaScript objects require significantly more heap space than the raw query string, particularly when property names trigger dense array allocations under V8 heuristics. An attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.

Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest concurrent request volume. This leads to an unrecoverable JavaScript heap out-of-memory fatal crash, terminating the SSR worker. The advisory notes that numeric query parameter names trigger larger V8 property-storage allocations, lowering the concurrency threshold required to cause a crash.

Why it matters

The vulnerability affects widely used versions of the Angular framework, specifically npm package @angular/router versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0. Organizations relying on server-side rendering for their Angular applications are exposed if they have not applied the recent patches.

The patched versions are 21.2.25 and 22.2.1. The flaw requires no authentication, making it accessible to any remote attacker. Because the crash results from heap exhaustion, it effectively denies service to all users of the affected SSR worker until the process is restarted or replaced.

Our take on the response

• Verify if your application uses Angular Router versions prior to 21.2.25 or 22.2.1.
• Check if server-side rendering is enabled on Node.js environments.
• Review configuration for queryParamsHandling set to merge or preserve.
• Apply the available patches immediately to prevent heap exhaustion.

What defenders should look for

Teams usually monitor application logs for sudden spikes in memory usage or frequent worker restarts. Check whether SSR endpoints are receiving requests with unusually large query strings. Look for alerts indicating out-of-memory errors in Node.js processes. Defenders should also review access logs for patterns of high-concurrency requests targeting pages with multiple RouterLink directives. Initial containment moves involve restricting the size of incoming query parameters at the reverse proxy or load balancer level to mitigate the impact of oversized payloads.

What to do and how to stay safe: Angular

• Audit your deployment to identify if Angular Router versions 21.2.0-21.2.24 or 22.0.0-22.2.0 are in use.
• Verify if server-side rendering is enabled and if queryParamsHandling is set to merge or preserve.
• Update to Angular Router version 21.2.25 or 22.2.1 once the vendor provides an update.
• Monitor Node.js heap memory usage for abnormal growth during SSR requests.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Angular Router are vulnerable to this denial-of-service flaw?

Versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0 are affected by CVE-2026-111751.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows unauthenticated remote attackers to exhaust the Node.js heap.

What configurations must be present for the flaw to be exploitable?

Server-Side Rendering must be enabled on Node.js, and queryParamsHandling must be set to merge or preserve.