Angular RouterLink query parameter retention causes SSR denial of service
Sending long web addresses can make Angular web servers stall.
Summary
An attacker can send oversized query strings to Angular apps using server-side rendering (SSR), exhausting server memory until the SSR worker terminates. Versions from 21.2.0 until 21.2.25, and up to 22.2.1, are affected.
Affected when
- Node.js server-side rendering (SSR)
- queryParamsHandling set to merge or preserve
- Upstream proxies or load balancers forward oversized query strings
What to do
Update to Angular 21.2.25 or 22.2.1 or later.
Update to at least the version for your product:
- Angular 21.2 21.2.25 or later
- Angular 22.2 22.2.1 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen