Asymmetric Resource Consumption (Amplification) Affecting @angular/router package, versions <20.3.33>=21.0.0 <21.2.25>=22.0.0 <22.2.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ANGULARROUTER-21280762
- published20 Oct 2026
- disclosed20 Oct 2026
- creditUnknown
Introduced: 20 Oct 2026
NewCVE-2026-111752 (opens in a new tab)How to fix?
Upgrade @angular/router to version 20.3.33, 21.2.25, 22.2.1 or higher.
Overview
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the router's URL recognition logic (recognize.ts and config_matching.ts) when processing empty-path outlet groups in a request URL (such as x:/(detail:2), ///(detail:2), or x:/()) that have no corresponding route in the route configuration. The four affected code paths - processChildren, processSegmentAgainstRoute, matchSegmentAgainstRoute, and noLeftoversInUrl - allow unmatched zero-segment outlet groups to bypass route validation, enabling an attacker to trigger unbounded recursive processing that exhausts available heap memory and crashes the server process.
Note: This is only exploitable when worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB-1 GiB).