{"action":"Upgrade @angular/router to 20.3.32 or later.","affected":[{"fixed":"22.2.0","introduced":"22.0.0"},{"fixed":"21.2.24","introduced":"21.0.0"},{"fixed":"20.3.32","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/router","cve_ids":["CVE-2026-101896"],"ecosystem":"npm","epss":0.00756,"exploited":false,"fixed_versions":["22.2.0","21.2.24","20.3.32"],"ghsa_id":"GHSA-ff3f-86qr-9cv3","id":"tcs_01M5KFN9QP6WXGSEHZA22G58VX","modified_at":"2026-09-30T16:00:28.500151110Z","published_at":"2026-09-30T15:40:47Z","references":["https://osv.dev/vulnerability/GHSA-ff3f-86qr-9cv3","https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3","https://github.com/angular/angular/issues/70716","https://github.com/angular/angular/pull/70717","https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583","https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d","https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4","https://github.com/angular/angular"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-ff3f-86qr-9cv3","url":"https://osv.dev/vulnerability/GHSA-ff3f-86qr-9cv3"},{"source":"nvd","source_id":"CVE-2026-101896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101896"}],"summary":"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters"}