@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.2.0, < 21.2.25 → 21.2.25

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the re…

在 GitHub Advisory Database 阅读

2026/10/21 02:52，GitHub Advisory Database 发布了“@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js、Angular、GitHub。CVE：CVE-2026-111751。