npm/@angular/router CVE-2026-111751: high
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
Action: Upgrade @angular/router to 21.2.25 or later.
npm i @angular/router@22.2.1npm i @angular/router@21.2.25Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.2.1 | - |
| 21.2.0 | 21.2.25 | - |
Fixed versions
| 22.2.1 | 21.2.25 |
Sources
- osv: GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh
- https://github.com/angular/angular/issues/70908
- https://github.com/angular/angular/pull/70953
- https://github.com/angular/angular/commit/319a3c4f3268f4f96ac4acdbb118737d2261e0be
- https://github.com/angular/angular
CVE-2026-111751 · published · modified · JSON