{"action":"Upgrade @angular/platform-server to 20.3.31 or later.","affected":[{"fixed":"22.1.6","introduced":"22.0.0"},{"fixed":"21.2.23","introduced":"21.0.0"},{"fixed":"20.3.31","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-101895"],"ecosystem":"npm","epss":0.00716,"exploited":false,"fixed_versions":["22.1.6","21.2.23","20.3.31"],"ghsa_id":"GHSA-f67j-2jqw-jpq7","id":"tcs_01M5KFMMRPDJR6P2TMGXY13MPZ","modified_at":"2026-09-28T21:45:03.879204328Z","published_at":"2026-09-28T21:31:21Z","references":["https://osv.dev/vulnerability/GHSA-f67j-2jqw-jpq7","https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7","https://github.com/angular/angular"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-f67j-2jqw-jpq7","url":"https://osv.dev/vulnerability/GHSA-f67j-2jqw-jpq7"}],"summary":"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE"}