@angular/router 22.1.8

Direct Vulnerabilities

Known vulnerabilities in the @angular/router package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `RouterLink` directive's `_urlTree` computed signal, which permanently caches a `UrlTree` instance (including its cloned query parameter map and segment tree) in `ReactiveNode.value` for the lifetime of every `<a routerLink>` element in a view. During server-side rendering (SSR), each rendered link pins a full copy of the query parameter map in the heap. In an application with many links and large query parameter sets, this causes server workers to crash with an Out of Memory (OOM) error under concurrent load. Note: This is only exploitable when the application is rendered server-side (SSR) and has a significant number of `routerLink` elements combined with large query parameter payloads or `defaultQueryParamsHandling: 'merge'` enabled. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `@angular/router` to version 22.2.1, 21.2.25 or higher.	>=22.0.0 <22.2.1>=21.2.0 <21.2.25
H Asymmetric Resource Consumption (Amplification) Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the router's URL recognition logic (`recognize.ts` and `config_matching.ts`) when processing empty-path outlet groups in a request URL (such as `x:/(detail:2)`, `///(detail:2)`, or `x:/()`) that have no corresponding route in the route configuration. The four affected code paths - `processChildren`, `processSegmentAgainstRoute`, `matchSegmentAgainstRoute`, and `noLeftoversInUrl` - allow unmatched zero-segment outlet groups to bypass route validation, enabling an attacker to trigger unbounded recursive processing that exhausts available heap memory and crashes the server process. Note: This is only exploitable when worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB-1 GiB). How to fix Asymmetric Resource Consumption (Amplification)? Upgrade `@angular/router` to version 20.3.33, 21.2.25, 22.2.1 or higher.	<20.3.33>=21.0.0 <21.2.25>=22.0.0 <22.2.1
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dense array backing store sized to the largest index, amplifying an 11 byte segment into 20 to 25 KB of heap. An attacker can exhaust the old space heap of a server side rendering worker and crash it with a JavaScript heap out of memory error, by sending requests whose paths repeat numeric matrix parameters, such as `/a;990;2522/a;990;2522/`, with 12 to 22 concurrent 8 KB paths sufficient against a 256 to 512 MiB worker. This requires server side rendering on Node.js with user controlled URLs reaching the router, so client side single page applications are unaffected, and it depends on no reverse proxy filtering semicolons or capping path segments ahead of the application. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `@angular/router` to version 20.3.32, 21.2.24, 22.2.0 or higher.	<20.3.32>=21.0.0 <21.2.24>=22.0.0 <22.2.0

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the RouterLink directive's _urlTree computed signal, which permanently caches a UrlTree instance (including its cloned query parameter map and segment tree) in ReactiveNode.value for the lifetime of every <a routerLink> element in a view. During server-side rendering (SSR), each rendered link pins a full copy of the query parameter map in the heap. In an application with many links and large query parameter sets, this causes server workers to crash with an Out of Memory (OOM) error under concurrent load.

Note: This is only exploitable when the application is rendered server-side (SSR) and has a significant number of routerLink elements combined with large query parameter payloads or defaultQueryParamsHandling: 'merge' enabled.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade @angular/router to version 22.2.1, 21.2.25 or higher.

>=22.0.0 <22.2.1>=21.2.0 <21.2.25

Asymmetric Resource Consumption (Amplification)

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the router's URL recognition logic (recognize.ts and config_matching.ts) when processing empty-path outlet groups in a request URL (such as x:/(detail:2), ///(detail:2), or x:/()) that have no corresponding route in the route configuration. The four affected code paths - processChildren, processSegmentAgainstRoute, matchSegmentAgainstRoute, and noLeftoversInUrl - allow unmatched zero-segment outlet groups to bypass route validation, enabling an attacker to trigger unbounded recursive processing that exhausts available heap memory and crashes the server process.

Note: This is only exploitable when worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB-1 GiB).

How to fix Asymmetric Resource Consumption (Amplification)?

Upgrade @angular/router to version 20.3.33, 21.2.25, 22.2.1 or higher.

<20.3.33>=21.0.0 <21.2.25>=22.0.0 <22.2.1

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dense array backing store sized to the largest index, amplifying an 11 byte segment into 20 to 25 KB of heap. An attacker can exhaust the old space heap of a server side rendering worker and crash it with a JavaScript heap out of memory error, by sending requests whose paths repeat numeric matrix parameters, such as /a;990;2522/a;990;2522/, with 12 to 22 concurrent 8 KB paths sufficient against a 256 to 512 MiB worker. This requires server side rendering on Node.js with user controlled URLs reaching the router, so client side single page applications are unaffected, and it depends on no reverse proxy filtering semicolons or capping path segments ahead of the application.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade @angular/router to version 20.3.32, 21.2.24, 22.2.0 or higher.

<20.3.32>=21.0.0 <21.2.24>=22.0.0 <22.2.0

@angular/router@22.1.8

Angular - the routing library

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically