Update dependency @angular/router to v21.2.25 [SECURITY] by renovate[bot] · Pull Request #94 · ls1intum/Module-Management

renovate · 2026-10-20T20:38:04Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/router (source)	`21.1.4` → `21.2.25`

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

CVE-2026-111752 / GHSA-62vg-58rm-qff7

More information

Details

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8).

During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(...), or ///(...)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.

When a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate ActivatedRouteSnapshot trees, repeatedly execute canMatch guards and route resolvers, and allocate separate copies of route parameters and queryParams for each unconfigured outlet.

An unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.

Impact

Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js heap with a single crafted request or a small number of concurrent requests, terminating the SSR worker process with a fatal JavaScript heap out-of-memory crash. When the matched routes declare canMatch guards or resolvers, a single short request can also trigger repeated guard or resolver executions, increasing load on backend services and holding worker connections open.

Transient Allocation: Memory is released once route recognition completes; there is no persistent memory leak. The primary impact is process termination.
Client-side SPAs Unaffected: Client-side Angular applications running in the browser are not vulnerable, as browser memory consumption does not cross a security boundary.
Prerendering (SSG) Unaffected: Build-time prerendering does not process attacker-supplied request URLs.

Attack Preconditions & Vulnerable Configurations

An application is affected only if all of the following conditions are met:

SSR Enabled: The application renders on demand on a Node.js / V8 server.
Susceptible Route Configuration: At least one level of the route configuration contains either:
- an empty-path (path: "") route (e.g., {path: "", component: ShopPage}), or
- a route assigned to a named outlet (e.g., {path: "dashboard", children: [{path: ":id", outlet: "detail", component: DetailPanel}]}).
Upstream Request Line Forwarding: Request lines reach the Node.js process without being rejected upstream by edge proxies. Node.js accepts request headers up to 16 KiB by default. Guard/resolver amplification requires only a short URL.
Constrained Heap Size: Worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB–1 GiB).

Exploit Payload Examples

Against a configuration with empty-path (path: "") routes and query parameters:

GET /shop/(a:/()//b:/()//c:/()//...)?param1=value&param2=value... HTTP/1.1
Host: example.com

Against a configuration with named-outlet or sibling routes:

GET /dashboard/(detail:1//x:/(detail:1//x:/(...)//y:/(...))//y:/(...)) HTTP/1.1
Host: example.com

Patches

The issue is resolved in angular/angular#71055. The router now requires every child outlet segment group to match a route configured for its target outlet before unwrapping child segments or completing a match, and prevents unconfigured empty-path outlet groups from matching routes declared for other outlets.

Patched versions:

22.2.1
21.2.25
20.3.33

Versions prior to v20 are also affected but are no longer supported and will not receive a patch.

Workarounds & Mitigations

If you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:

Reject Parenthesized or Empty-Path Outlet URLs in Middleware or WAF (Recommended):
In @angular/router, auxiliary outlet groups in a URL always use parentheses (...), and empty-path outlet groups in a URL always take the form :/( , (/ , or ///( .

If your application does not use named (auxiliary) outlets in URLs, reject requests whose path contains ( or ) before Angular SSR handles the request.
If your application does use named outlets, reject requests whose path contains empty-path outlet sequences (:/( , (/ , or ///( ).

Unlike URL length limits, this completely blocks both heap exhaustion and short-URL guard/resolver amplification:

// server.ts (placed before Angular SSR handler)
app.use((req, res, next) => {
  let pathname: string;
  try {
    pathname = decodeURI(req.url.split(/[?#]/, 1)[0]);
  } catch {
    res.status(400).send("Bad Request");
    return;
  }

  // Option A: If the app does not use named outlets in URLs, block all parenthesized groups:
  if (/[()]/.test(pathname)) {
    res.status(400).send("Bad Request");
    return;
  }

  // Option B: If the app uses named outlets, block only empty-path outlet groups:
  if (/:\/\(|\(\//\(|\/\/\/\(/.test(pathname)) {
    res.status(400).send("Bad Request");
    return;
  }

  next();
});

Limit URL Length at Reverse Proxy or Middleware:
Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long URLs (e.g., exceeding 2,048 bytes). The outlet portion of the payload is in the path, so limit the full request target, not only the query string. This reduces, but does not eliminate, guard/resolver amplification, which requires only a short URL.
Increase Node.js Old Space:
Increasing --max-old-space-size raises the request size and concurrency required to exhaust memory, though it does not eliminate the issue.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/router)

Commit	Type	Description
4bc11a546b	fix	do not copy URL-sized objects into every route snapshot
6489ca5d84	fix	reject duplicate outlets in production builds
a83f8119ac	fix	require outlets to match a route before processing child segments
a131f77d92	perf	do not retain UrlTree instances in RouterLink

Commit	Type	Description
5aa6d97deb	fix	avoid stripping unicode whitespace during url resolution
73d8bbd27c	fix	update domino to latest version

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

Commit	Type	Description
3fd6897a67	fix	harden inherit definition feature against polluted prototypes
7e38336dc7	fix	use Object.create(null) for LOCALE_DATA as a hardening measure

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG <style> elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

Commit	Type	Description
66821c4ed5	fix	throw on suspicious URLs and restrict protocol-relative URLs
d3170031b6	fix	update domino to latest version

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

Commit	Type	Description
c0f52272ed	fix	do not insert todo when migrating void @Output
938a7f3edd	fix	makes resource URL sanitizer lookup case-insensitive
0fb2724194	fix	reject script element as a dynamic component host
49113ac0ef	fix	visit ICU expressions in signal migration schematics

Commit	Type	Description
629905d537	fix	add `allowedHosts` option to `renderModule` and `renderApplication`
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

Commit	Type	Description
a40e2cebc8	fix	fix ordering of view queries metadata in JIT mode
885a1a1d97	fix	guard against non-object events and avoid listener wrapper identity mismatch
7a64aff9b5	fix	prevent event replay double-invocation when element hydrates before app stability

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

Conversation

renovate Bot commented Oct 20, 2026

@​angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

Details

Impact

Attack Preconditions & Vulnerable Configurations

Exploit Payload Examples

Patches

Workarounds & Mitigations

Severity

References

Release Notes

platform-server

router

router

platform-server

platform-server

platform-browser

core

http

compiler

http

platform-server

compiler-cli

core

http

service-worker

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

common

compiler

core

platform-server

common

compiler

core

http

platform-server

service-worker

compiler

core

router

core

platform-server

core

forms

common

compiler

core

platform-server

docs

migrations

router

core

http

platform-server

router

compiler

compiler-cli

core

language-service

compiler

compiler-cli

core

localize

router

common

compiler

core

migrations

compiler

compiler-cli

Configuration

Uh oh!

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

renovate Bot commented Oct 20, 2026 •

edited

Loading

Commit	Type	Description
82192deda9	fix	handle missing serialized container hydration data
057cc6d09d	fix	remove obsolete iOS cursor pointer hack in event delegation

Commit	Type	Description
d04ddd73df	fix	prevent binding unsafe attributes on SVG animation elements (#67797)
8fd896e99a	fix	resolve component import by exact specifier in route lazy-loading schematic
b682c62873	fix	treat `object[data]` as resource URL context (#67797)

Commit	Type	Description
334ae10168	fix	ensure generated code compiles
23ea431c4e	fix	parse named HTML entities containing digits

Commit	Type	Description
26c43d14ba	fix	escape template literal in TCB
67e0ba7e03	fix	generic types not filled out correctly in ty