CVE-2026-111752

A flaw was found in @angular/router. Prior to versions 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak; client-side SPAs and build-time prerendering are not affected. This issue is fixed in @angular/router 20.3.33, 21.2.25, and 22.2.1.

Red Hat products that ship @angular/router (the Ceph dashboard, Red Hat Advanced Cluster Management volsync, and Fuse 7 UI artifacts) bundle it only inside client-side single-page applications that execute in the user's browser. Exploitation of this flaw requires Angular Server-Side Rendering (SSR) on Node.js, which none of these products use; client-side Angular applications are not vulnerable. All affected Red Hat products have therefore been assessed as NOTAFFECTED and no update is required.

For custom applications built on @angular/router with SSR enabled on Node.js, the following mitigations apply:

1. Update to a patched version: @angular/router 22.2.1, 21.2.25, or 20.3.33. Versions below v20 are affected but are no longer supported upstream and will not receive a fix.

2. If updating is not immediately possible, reject crafted outlet-segment URLs before they reach the Angular SSR handler:

- If the application does not use named (auxiliary) outlets in URLs, reject any request whose path contains "(" or ")".

- If named outlets are used, reject request paths containing empty-path outlet sequences: ":/(", "(/", or "///(".

3. Limit the full request-target length (not only the query string) at the reverse proxy or WAF, for example to 2048 bytes. Note that guard/resolver amplification is possible with short URLs, so URL length limits alone are not sufficient.

4. Increasing the Node.js --max-old-space-size raises the request size and concurrency needed to exhaust the worker heap, reducing but not eliminating the risk.