CVE-2026-111751: @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling.

Starting in v21.2.0 (angular/angular#66181), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the returned UrlTree instance on the directive. Because each rendered link maintains an active RouterLink instance for the entire duration of the request lifecycle, the computed signal permanently pinned the UrlTree and its associated query parameter dictionary in the heap until the SSR response completed.

When query parameter handling is set to 'merge' or 'preserve', each link copies the incoming request’s query parameters into its own UrlTree. During SSR, memory consumption scales multiplicatively:

$$\text{Heap Retention} \approx (\text{Number of affected links}) \times (\text{Size of parsed query parameter map})$$

Because parsed JavaScript objects and property dictionaries require substantially more heap space than the raw query string—particularly when property names trigger dense array allocations under V8 property-storage heuristics—an attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.