Skip to content
OpenAdvisories
Medium WID-SEC-2026-3972 3 CVEs

Angular Platform-Server, Router und DevTools: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 14, 2026 · Updated Oct 14, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Angular ist ein TypeScript-basiertes Front-End-Webapplikationsframework. Es ist eine Weiterentwicklung des JavaScript basierten AngularJS.

Vulnerabilities 3

  • High 8.7
    CVE-2026-101895

    Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop…

    angular angular platform-server angular.js Debian Ubuntu npm
  • High 8.2
    CVE-2026-101896

    Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet …

    angular angular router angular.js Debian Ubuntu npm
  • Medium 5.1
    CVE-2026-101897

    Angular DevTools (Local DoS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages fr…

    angular angular DevTools angular.js Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References