Is CVE-2026-111752 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111752 being exploited in the wild.

How severe is CVE-2026-111752?

High severity, with a CVSS score of 4, published 3 November 2026.

Which products and versions are affected?

Angular @Angular/Router prior to 20.3.33, 21.2.25, or 22.2.1; @angular/router (npm) >= 22.0.0, < 22.2.1, SEMVER:introduced=22.0.0,fixed=22.2.1.

How is CVE-2026-111752 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111752?

Check whether you run Angular @Angular/Router or @angular/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111752: Angular router denial of service via unmatched empty-path outlet matching in SSR

Q: Is there a fix for CVE-2026-111752?

Yes. @angular/router (npm): upgrade to 22.2.1 or later. Until then: Reject requests with parenthesized or empty-path outlet patterns in middleware or WAF before Angular SSR processes them (block `/(` or `)` if named outlets are unused, or block `:/(``, `(/`, or `///(` patterns if named outlets are in use). Alternatively, configure reverse proxy or WAF to reject requests exceeding 2,048 bytes, or increase Node.js old space heap size with `--max-old-space-size`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-111752 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-111752?

Check whether you run Angular @Angular/Router or @angular/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111752 · Severity: high · CVSS 4 · Published 2026-11-03

Angular's server-side rendering (SSR) router fails to validate whether auxiliary outlet segments in URLs match configured routes, allowing attackers to send crafted requests that force the router to duplicate route evaluation, exhaust Node.js process memory, and crash the server. An unauthenticated attacker can terminate SSR worker processes with a single malicious request, causing service disruption for web applications using Angular with SSR enabled.

Technologies: @angular/router (npm). Vendors: Angular, npm.

Quick answers

Is CVE-2026-111752 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111752 being exploited in the wild.
How severe is CVE-2026-111752?: High severity, with a CVSS score of 4, published 3 November 2026.
Which products and versions are affected?: Angular @Angular/Router prior to 20.3.33, 21.2.25, or 22.2.1; @angular/router (npm) >= 22.0.0, < 22.2.1, SEMVER:introduced=22.0.0,fixed=22.2.1.
Is there a fix for CVE-2026-111752?: Yes. @angular/router (npm): upgrade to 22.2.1 or later. Until then: Reject requests with parenthesized or empty-path outlet patterns in middleware or WAF before Angular SSR processes them (block `/(` or `)` if named outlets are unused, or block `:/(``, `(/`, or `///(` patterns if named outlets are in use). Alternatively, configure reverse proxy or WAF to reject requests exceeding 2,048 bytes, or increase Node.js old space heap size with `--max-old-space-size`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111752 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111752?: Check whether you run Angular @Angular/Router or @angular/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/router (npm): upgrade to 22.2.1 or later
```
npm install @angular/router@22.2.1
```

Reject requests with parenthesized or empty-path outlet patterns in middleware or WAF before Angular SSR processes them (block `/(` or `)` if named outlets are unused, or block `:/(``, `(/`, or `///(` patterns if named outlets are in use). Alternatively, configure reverse proxy or WAF to reject requests exceeding 2,048 bytes, or increase Node.js old space heap size with `--max-old-space-size`.

Technical details

The vulnerability is a denial of service in @angular/router's route matching logic during SSR on Node.js. When unconfigured empty-path outlet groups (e.g., `a:/()`, `x:/(...)`), or `///(...)`) appear in a URL, the router fails to reject them and instead re-evaluates the route configuration against each arbitrary outlet segment, instantiating duplicate ActivatedRouteSnapshot trees and repeatedly executing canMatch guards and resolvers. An attacker exploits this by sending URLs with multiple arbitrary empty-path outlet segments to exhaust the V8 heap or overwhelm CPU, terminating the SSR worker process.

Affected products

Angular @angular/router prior to 20.3.33, 21.2.25, or 22.2.1

Identifiers

CVE-2026-111752
GHSA-62vg-58rm-qff7

Timeline

2026-10-20: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.