Advisories for Npm/@Angular/Router package

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(…), or ///(…)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet …

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting in v21.2.0 (angular/angular#66181), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the returned UrlTree instance on the directive. Because each rendered link maintains an active RouterLink …

A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects (Record<string, string>). When matrix parameter names or outlet names are numeric strings (such as /a;990;2522), the V8 JavaScript engine interprets them as array-indexed properties rather than named properties. Under V8's internal property-storage …