npm/@angular/router CVE-2026-111752: high
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
Action: Upgrade @angular/router to 20.3.33 or later.
npm i @angular/router@22.2.1npm i @angular/router@21.2.25npm i @angular/router@20.3.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.2.1 | - |
| 21.0.0 | 21.2.25 | - |
| 20.0.0 | 20.3.33 | - |
| 0 | - | 19.2.25 |
Fixed versions
| 22.2.1 | 21.2.25 | 20.3.33 |
Sources
- osv: GHSA-62vg-58rm-qff7
- https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7
- https://github.com/angular/angular/issues/70997
- https://github.com/angular/angular/pull/71055
- https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c
- https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0
- https://github.com/angular/angular/commit/b6bf6504adab1a78cc62ad8402f6bed229e620bd
- https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79
- https://github.com/angular/angular
CVE-2026-111752 · published · modified · JSON