CVE-2026-101895

Awaiting Analysis Awaiting Analysis - Queue

Infinite Loop in Angular SSR DOM Parser via Incomplete DOCTYPE

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101895

EUVD

EUVD-2026-101126

Affected Vendors & Products

Vendor	Product	Version / Range
angular	angular	<= 19.2.25
angular	angular	>= 20.0.0, < 20.3.31
angular	angular	>= 21.0.0, < 21.2.23
angular	angular	>= 22.0.0, < 22.1.6
@angular/	platform-server	<= 19.2.25
@angular/	platform-server	>= 20.0.0, < 20.3.31
@angular/	platform-server	>= 21.0.0, < 21.2.23
@angular/	platform-server	>= 22.0.0, < 22.1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in Angular's Server-Side Rendering (SSR) where the DOM emulation parser (domino) enters an infinite loop when processing attacker-controlled HTML with an incomplete DOCTYPE ending in whitespace. The parser fails to advance past the EOF marker, causing 100% CPU consumption and freezing the Node.js server.

Detection Guidance

Detecting this vulnerability requires checking Angular SSR versions and analyzing server logs for CPU spikes during HTML parsing. Inspect package.json files for @angular/platform-server versions below 20.3.31, 21.2.23, or 22.1.6. Monitor server processes for sustained 100% CPU usage when handling requests with user-controlled HTML input.

Impact Analysis

An unauthenticated remote attacker can exploit this by sending malicious HTML to an Angular SSR application, causing the server to become unresponsive. This stops all concurrent and subsequent requests, effectively taking the service offline until restarted.

Compliance Impact

This vulnerability enables a Denial of Service (DoS) attack by causing 100% CPU consumption and freezing the Node.js server process. Such disruptions can lead to prolonged downtime, violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)). Unavailability of systems may also impact data integrity and access controls.

Mitigation Strategies

Upgrade @angular/platform-server to versions 20.3.31, 21.2.23, or 22.1.6 immediately. Avoid binding untrusted input to [innerHTML]; use [textContent] or text interpolation instead. Validate or sanitize user input to remove strings starting with <!DOCTYPE. Implement rate limiting and request timeouts to limit DoS impact.

Hi! I’m here to help you understand CVE-2026-101895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70