Is CVE-2026-111751 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111751 being exploited in the wild.

How severe is CVE-2026-111751?

High severity, with a CVSS score of 4, published 3 November 2026.

Which products and versions are affected?

Angular @Angular/Router 21.2.0 through 21.2.24, 22.0.0 through 22.2.0; @angular/router (npm) >= 22.0.0, < 22.2.1, SEMVER:introduced=22.0.0,fixed=22.2.1.

How is CVE-2026-111751 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111751?

Check whether you run Angular @Angular/Router or @angular/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111751: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.

Q: Is there a fix for CVE-2026-111751?

Yes. @angular/router (npm): upgrade to 22.2.1 or later. Until then: Remove `defaultQueryParamsHandling: 'merge'` or `'preserve'` from global configuration and bind only required query parameters explicitly to each RouterLink. Configure reverse proxies, WAF, or Node.js middleware to reject requests with query strings exceeding 2,048 bytes (e.g., returning HTTP 414). [{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-20","note":"Patches released for versions 22.2.1 and 21.2.25"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-111751 · Severity: high · CVSS 4 · Published 2026-11-03

Angular's router component, used to navigate between pages in web applications, has a flaw when running on Node.js servers that render pages server-side. An attacker can send specially crafted requests with extremely long query strings to crash the server's memory, causing the application to become unavailable. This only affects applications using specific query parameter handling options and does not impact client-side-only applications.

Technologies: @angular/router (npm). Vendors: Angular, npm.

Quick answers

Is CVE-2026-111751 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111751 being exploited in the wild.
How severe is CVE-2026-111751?: High severity, with a CVSS score of 4, published 3 November 2026.
Which products and versions are affected?: Angular @Angular/Router 21.2.0 through 21.2.24, 22.0.0 through 22.2.0; @angular/router (npm) >= 22.0.0, < 22.2.1, SEMVER:introduced=22.0.0,fixed=22.2.1.
Is there a fix for CVE-2026-111751?: Yes. @angular/router (npm): upgrade to 22.2.1 or later. Until then: Remove `defaultQueryParamsHandling: 'merge'` or `'preserve'` from global configuration and bind only required query parameters explicitly to each RouterLink. Configure reverse proxies, WAF, or Node.js middleware to reject requests with query strings exceeding 2,048 bytes (e.g., returning HTTP 414).</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-20","note":"Patches released for versions 22.2.1 and 21.2.25"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111751 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111751?: Check whether you run Angular @Angular/Router or @angular/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/router (npm): upgrade to 22.2.1 or later
```
npm install @angular/router@22.2.1
```

Remove `defaultQueryParamsHandling: 'merge'` or `'preserve'` from global configuration and bind only required query parameters explicitly to each RouterLink. Configure reverse proxies, WAF, or Node.js middleware to reject requests with query strings exceeding 2,048 bytes (e.g., returning HTTP 414).</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-20","note":"Patches released for versions 22.2.1 and 21.2.25"}]

Technical details

A cached computed signal in RouterLink (introduced in v21.2.0) retains UrlTree instances and their associated query parameter dictionaries on the heap for the entire duration of SSR request processing. When queryParamsHandling is set to 'merge' or 'preserve', each RouterLink copies the incoming request's query parameters into its own UrlTree; attackers exploit this by sending oversized query strings that amplify heap consumption multiplicatively across multiple concurrent links. The attacker requires SSR enabled, upstream proxies forwarding long query strings, and multiple concurrent requests to exhaust the Node.js old-space heap without authentication.

Affected products

Angular @angular/router 21.2.0 through 21.2.24, 22.0.0 through 22.2.0

Identifiers

CVE-2026-111751
GHSA-57xq-rjx2-v5xh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.