{"action":"Upgrade @angular/router to 20.3.33 or later.","affected":[{"fixed":"22.2.1","introduced":"22.0.0"},{"fixed":"21.2.25","introduced":"21.0.0"},{"fixed":"20.3.33","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/router","cve_ids":["CVE-2026-111752"],"ecosystem":"npm","exploited":false,"fixed_versions":["22.2.1","21.2.25","20.3.33"],"ghsa_id":"GHSA-62vg-58rm-qff7","id":"tcs_01M5JK8042RZC4V3723MVX6DZB","modified_at":"2026-10-20T14:45:03.782725740Z","published_at":"2026-10-20T14:36:39Z","references":["https://osv.dev/vulnerability/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/b6bf6504adab1a78cc62ad8402f6bed229e620bd","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-62vg-58rm-qff7","url":"https://osv.dev/vulnerability/GHSA-62vg-58rm-qff7"}],"summary":"@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)"}