CVE-2026-101895
Received
Received - Intake
Infinite Loop in Angular SSR DOM Parser via Incomplete DOCTYPE
Vulnerability report for CVE-2026-101895, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: GitHub, Inc.
Description
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| angular | angular | <= 19.2.25 |
| angular | angular | >= 20.0.0, < 20.3.31 |
| angular | angular | >= 21.0.0, < 21.2.23 |
| angular | angular | >= 22.0.0, < 22.1.6 |
| @angular/ | platform-server | <= 19.2.25 |
| @angular/ | platform-server | >= 20.0.0, < 20.3.31 |
| @angular/ | platform-server | >= 21.0.0, < 21.2.23 |
| @angular/ | platform-server | >= 22.0.0, < 22.1.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
