{"id":"ghsa-ghsa-62vg-58rm-qff7","seq":2430,"kind":"advisory","title":"@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","url":"https://github.com/advisories/GHSA-62vg-58rm-qff7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-62vg-58rm-qff7","summary":"影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.0.0, < 21.2.25 → 21.2.25, npm:@angular/router >= 20.0.0, < 20.3.33 → 20.3.33, npm:@angular/router <= 19.2.25\nA denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(...), or ///(...)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrar…","severity":"high","techs":["nodejs","angular"],"cves":["CVE-2026-111752"],"tags":["GHSA-62vg-58rm-qff7","@angular/router","@angular/router","@angular/router","@angular/router"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T14:36:39.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}