Answer in brief
CVE-2026-111751 records a High severity (CVSS 8.2) vulnerability in Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR). The current sources do not mark it as known exploited. The current feed maps angular/angular (generic), @angular/router (npm), @angular/router (npm), @angular/router (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps angular/angular (generic), @angular/router (npm), @angular/router (npm), @angular/router (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| angular/angulargeneric | >=21.2.0 <21.2.25 || >=22.0.0 <22.2.1 | 21.2.25, 22.2.1 |
| @angular/routernpm | >=22.0.0,<22.2.1 | 22.2.1 |
| @angular/routernpm | >=21.2.0,<21.2.25 | 21.2.25 |
| @angular/routernpm | >=22.0.0 <22.2.1 | 22.2.1 |
| @angular/routernpm | >=21.2.0 <21.2.25 | 21.2.25 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.
Quoted source text, attributed separately from HOL analysis.