CVE-2026-111752: @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8).

During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(...), or ///(...)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.

When a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate ActivatedRouteSnapshot trees, repeatedly execute canMatch guards and route resolvers, and allocate separate copies of route parameters and queryParams for each unconfigured outlet.

An unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.