{"id":"ghsa-ghsa-57xq-rjx2-v5xh","seq":2429,"kind":"advisory","title":"@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","url":"https://github.com/advisories/GHSA-57xq-rjx2-v5xh","permalink":"https://vulnpulse.app/items/ghsa-ghsa-57xq-rjx2-v5xh","summary":"影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.2.0, < 21.2.25 → 21.2.25\nA denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the re…","severity":"high","techs":["nodejs","angular","github"],"cves":["CVE-2026-111751"],"tags":["GHSA-57xq-rjx2-v5xh","@angular/router","@angular/router"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T17:52:32.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}