AIKIDO-2026-426226
@angular/router is vulnerable to Denial of Service (DoS)
82
High Risk
This Affects:
@angular/routerTL;DR
During server side rendering, @angular/router's route recognizer does not check that an auxiliary outlet segment matches a route configured for that outlet name. Unconfigured empty path outlet groups such as a:/() or ///(...) pass through route matching, so for each crafted outlet segment the recognizer processes the route configuration, builds duplicate ActivatedRouteSnapshot trees, and runs canMatch guards and resolvers, which can exhaust the Node.js heap or CPU and crash the SSR worker. The fix rejects an outlet match when the route has no children to descend into or the URL segment has nothing left to match.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render your application with server side rendering (SSR) enabled.
Background info
@angular/router is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 20.3.32, 21.0.0 - 21.2.24 and 22.0.0 - 22.2.0.
How to fix this
Upgrade the @angular/router library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.