Infinite loop Affecting @angular/platform-server package, versions <20.3.31>=21.0.0 <21.2.23>=22.0.0 <22.1.6
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ANGULARPLATFORMSERVER-20255568
- published29 Sept 2026
- disclosed28 Sept 2026
- creditVenkatKwest
Introduced: 28 Sep 2026
CVE-2026-101895 (opens in a new tab)How to fix?
Upgrade @angular/platform-server to version 20.3.31, 21.2.23, 22.1.6 or higher.
Overview
@angular/platform-server is an Angular - library for using Angular in Node.js
Affected versions of this package are vulnerable to Infinite loop via the after_doctype_name_state handler in Domino's HTML parser (lib/HTMLParser.js), used by @angular/platform-server for server-side rendering. When untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF (such as <!DOCTYPE html ) is bound to [innerHTML] or processed through DOM APIs, the tokenizer's EOF branch fails to advance the character index pointer nextchar or transition out of the state. The scanner loop (while (nextchar < numchars)) therefore re-invokes after_doctype_name_state indefinitely, pegging CPU at 100% and freezing the Node.js server process, preventing it from responding to any further requests.
Note: This is only exploitable when untrusted user input is bound to [innerHTML], interpolated into markup, or sanitized on the server in an Angular SSR application.
Workaround
Avoid binding untrusted user input directly to [innerHTML] in server-rendered templates; use standard text interpolation ({{ userInput }}) or [textContent] when raw HTML rendering is not required. Alternatively, validate or sanitize user input before passing it to [innerHTML] on the server by stripping or rejecting strings matching /^<!DOCTYPE/i.