Infinite loop Affecting @angular/platform-server package, versions <20.3.31>=21.0.0 <21.2.23>=22.0.0 <22.1.6

@angular/platform-server is an Angular - library for using Angular in Node.js

Affected versions of this package are vulnerable to Infinite loop via the after_doctype_name_state handler in Domino's HTML parser (lib/HTMLParser.js), used by @angular/platform-server for server-side rendering. When untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF (such as <!DOCTYPE html ) is bound to [innerHTML] or processed through DOM APIs, the tokenizer's EOF branch fails to advance the character index pointer nextchar or transition out of the state. The scanner loop (while (nextchar < numchars)) therefore re-invokes after_doctype_name_state indefinitely, pegging CPU at 100% and freezing the Node.js server process, preventing it from responding to any further requests.

Note: This is only exploitable when untrusted user input is bound to [innerHTML], interpolated into markup, or sanitized on the server in an Angular SSR application.

Avoid binding untrusted user input directly to [innerHTML] in server-rendered templates; use standard text interpolation ({{ userInput }}) or [textContent] when raw HTML rendering is not required. Alternatively, validate or sanitize user input before passing it to [innerHTML] on the server by stripping or rejecting strings matching /^<!DOCTYPE/i.

• Maintainer's Advisory