AIKIDO-2026-275429
@angular/platform-server is vulnerable to Denial of Service (DoS)
87
High Risk
This Affects:
@angular/platform-serverTL;DR
Angular's server-side rendering relies on the bundled domino library to parse HTML, and its tokenizer's before-doctype-name state calls its EOF handling without advancing the scan pointer when a DOCTYPE declaration ends in whitespace right before end of input. Untrusted input reaching an [innerHTML] binding or similar sanitization path with such a malformed DOCTYPE causes the tokenizer to re-enter the same state indefinitely, freezing the single-threaded Node.js render process at full CPU. The fix updates the bundled domino parser so the end-of-input branch terminates correctly.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application renders untrusted input through an [innerHTML] binding or similar sanitization path during server-side rendering.
Background info
@angular/platform-server is vulnerable to Denial of Service (DoS) in versions 20.0.0 - 20.3.30, 21.0.0 - 21.2.22 and 22.0.0 - 22.1.5.
How to fix this
Upgrade the @angular/platform-server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.