CVE-2026-101896

Awaiting Analysis Awaiting Analysis - Queue

Heap Exhaustion in Angular Router via Numeric Matrix Parameters

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101896

EUVD

EUVD-2026-101147

Affected Vendors & Products

Vendor	Product	Version / Range
angular	angular	<= 19.2.25
angular	angular	>= 20.0.0, < 20.3.32
angular	angular	>= 21.0.0, < 21.2.24
angular	angular	>= 22.0.0, < 22.2.0
@angular	router	<= 19.2.25
@angular	router	>= 20.0.0, < 20.3.32
@angular	router	>= 21.0.0, < 21.2.24
@angular	router	>= 22.0.0, < 22.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a memory exhaustion vulnerability in Angular's router during Server-Side Rendering (SSR). When numeric matrix parameters or outlet names appear in URLs, V8 interprets them as array indices, causing disproportionate memory allocation. Attackers can send crafted URLs with repeated numeric segments to exhaust Node.js heap memory and crash the SSR worker.

Detection Guidance

To detect this vulnerability, monitor Node.js processes running Angular SSR for memory exhaustion patterns. Check for repeated numeric matrix parameters in URLs like /a;990;2522. Use commands like 'ps aux | grep node' to identify SSR workers and 'curl -v http://yourserver.com/a;1234;5678' to test URL parsing behavior.

Impact Analysis

If you run Angular SSR on Node.js, an attacker could send specially crafted URLs to crash your server by exhausting memory. This causes denial-of-service conditions where legitimate users cannot access your application. The impact is higher if you use proxies like Nginx or AWS ALB that allow semicolons in paths.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by exhausting Node.js heap memory during server-side rendering (SSR). It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged DoS conditions could disrupt service availability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade Angular to patched versions (20.3.32, 21.2.24, or 22.2.0). If upgrading is not immediately possible, block matrix parameters at the reverse proxy (e.g., Nginx 'location ~* \;\d+' deny) or enforce path segment limits. Increase Node.js heap size temporarily as a stopgap measure.

Hi! I’m here to help you understand CVE-2026-101896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70