{"id":"CVE-2026-101896","kind":"vulnerability","aliases":["CVE-2026-101896","GHSA-ff3f-86qr-9cv3"],"related":[],"title":"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters","description":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\r\n\r\nWhen `@angular/router` parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects (`Record<string, string>`). When matrix parameter names or outlet names are numeric strings (such as `/a;990;2522`), the V8 JavaScript engine interprets them as array-indexed properties rather than named properties.\r\n\r\nUnder V8's internal property-storage heuristics, setting numeric keys on an initially empty object causes V8 to allocate a dense array backing store (`HOLEY_ELEMENTS`) sized to the maximum index rather than falling back to sparse dictionary storage. Specifically, assigning sequential or moderately large numeric keys (like `990` followed by `2522`) causes V8 to allocate a contiguous backing store of ~2,522 pointers (~20 KB to 25 KB of heap) for a single 11-byte segment.\r\n\r\nBecause each segment in a URL path allocates its own independent `parameters` object, an attacker can craft URLs with repeated numeric matrix parameters to achieve an asymmetric memory amplification factor of approximately **~350x**.\r\n\r\n### Impact\r\n\r\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest request volume, terminating the SSR worker with an unrecoverable `JavaScript heap out of memory` fatal error and causing a Denial of Service.\r\n\r\n* **High Amplification:** A single 11-byte segment (`/a;990;2522`) consumes ~20 KB–25 KB of V8 heap.\r\n* **Low Concurrency Required:**\r\n  * With 8 KB request paths (~740 segments, within default Nginx 8 KB buffer limits), as few as **12–22 concurrent requests** crash a 256 MiB–512 MiB Node.js SSR worker.\r\n  * With smaller 1 KB–2 KB request paths (~90–180 segments), a burst of ~50–100 concurrent requests achieves the same heap exhaustion.\r\n* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are **not** vulnerable, as local browser memory consumption does not cross a security boundary.\r\n\r\n### Attack Preconditions & Vulnerable Configurations\r\n\r\nAn application is affected only if **all** of the following conditions are met:\r\n\r\n* **SSR Enabled:** The application runs in a Server-Side Rendering environment powered by Node.js / V8.\r\n* **Direct Router Parsing:** User-controlled request URLs are parsed by `@angular/router` during SSR.\r\n* **No Reverse-Proxy Semicolon/Segment Filtering:** Upstream reverse proxies (Nginx, Cloudflare, ALB) forward URLs containing semicolons (`;`) and multiple path segments without stripping or rejecting them.\r\n\r\n#### Exploit Payload Example\r\n\r\nAn attacker sends concurrent HTTP requests with repeated numeric matrix parameters:\r\n\r\n```http\r\nGET /a;990;2522/a;990;2522/a;990;2522/... HTTP/1.1\r\nHost: example.com\r\n```\r\n\r\nEven with paths under 2 KB, overlapping requests during SSR will rapidly consume the V8 heap until the process crashes.\r\n\r\n### Patches\r\n\r\nThe issue is resolved by updating `@angular/router` to enforce V8 dictionary elements storage (`setUrlDerivedKey`) for numeric URL-derived keys (index >= 32). This prevents V8 from allocating oversized contiguous array backing stores while preserving route matching, parameter values, and component input bindings.\r\n\r\n* `22.2.0`\r\n* `21.2.24`\r\n* `20.3.32`\r\n\r\n### Workarounds & Mitigations\r\n\r\nIf you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge or reverse proxy:\r\n\r\n1. **Block or Sanitize Matrix Parameters at the Reverse Proxy:**  \r\n   Configure your reverse proxy (e.g., Nginx, Cloudflare, or AWS WAF) to reject or strip semicolons (`;`) in request paths before forwarding requests to the Angular SSR service:\r\n   ```nginx\r\n   # Nginx example: reject requests containing matrix parameters\r\n   if ($uri ~* \";\") {\r\n       return 400;\r\n   }\r\n   ```\r\n2. **Enforce Strict Path Segment Limits:**  \r\n   Reject requests with excessive path depth (e.g., more than 20–30 segments).\r\n3. **Increase Node.js Old Space:**  \r\n   Increase `--max-old-space-size` (e.g., to 2048 or 4096 MB) to increase the concurrency threshold required to exhaust memory, though this does not fully eliminate the vulnerability under sustained traffic.\r\n\r\n### References\r\n\r\n* **Issue:** [angular/angular#70716](https://github.com/angular/angular/issues/70716)\r\n* **Fix PR:** [angular/angular#70717](https://github.com/angular/angular/pull/70717)","summary":"When Angular SSR runs on Node.js, numeric matrix parameters in request URLs make @angular/router allocate large V8 array backing stores, so a modest number of requests can exhaust the heap. An unauthenticated attacker can crash the server-side rendering worker with an out-of-memory error, causing denial of service.","severity":"high","cvss":8.2,"epss":0.00909,"exploited":false,"exploited_at":null,"products":[{"name":"@angular/router","fixed":["22.2.0"],"affected":">= 22.0.0, < 22.2.0","ecosystem":"npm"},{"name":"@angular/router","fixed":["21.2.24"],"affected":">= 21.0.0, < 21.2.24","ecosystem":"npm"},{"name":"@angular/router","fixed":["20.3.32"],"affected":">= 20.0.0, < 20.3.32","ecosystem":"npm"},{"name":"@angular/router","fixed":["End of Support / LTS expired; will not be patched"],"affected":"<= 19.2.25","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["angular","cwe-400","cwe-770","node.js","npm","package","ssr","web-frontend"],"not_affected_if":["client-side-only","proxy-strips-semicolons","static-export"],"how_to_check":"- Check the installed `@angular/router` version in `package-lock.json` or `yarn.lock`, or run `npm ls @angular/router`.\n- Confirm whether the app uses Angular Server-Side Rendering on Node.js.\n- Check whether the reverse proxy forwards URLs containing `;` and deep path segments to the SSR service.","fix":"- `@angular/router` 22.x: upgrade to `22.2.0`\n- `@angular/router` 21.x: upgrade to `21.2.24`\n- `@angular/router` 20.x: upgrade to `20.3.32`\n- `@angular/router` 19.2.25 and older: no fix; the line is out of support and will not be patched","status":"open","published_at":"2026-09-23T19:02:54+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","triaged_at":"2026-11-09T22:59:07+00:00","updated_at":"2026-11-09T22:59:07+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:59:07Z","model":"claude-haiku-5-5","output":{"fix":"- `@angular/router` 22.x: upgrade to `22.2.0`\n- `@angular/router` 21.x: upgrade to `21.2.24`\n- `@angular/router` 20.x: upgrade to `20.3.32`\n- `@angular/router` 19.2.25 and older: no fix; the line is out of support and will not be patched","reach":"internet","title":"Angular router: numeric matrix parameters let unauthenticated requests exhaust SSR memory","impact":"medium","summary":"When Angular SSR runs on Node.js, numeric matrix parameters in request URLs make @angular/router allocate large V8 array backing stores, so a modest number of requests can exhaust the heap. An unauthenticated attacker can crash the server-side rendering worker with an out-of-memory error, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["angular","ssr","node.js","npm","web-frontend"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests crash the SSR worker through heap exhaustion","analyst_note":"Confirm the 19.x end-of-support status and whether a patched 19.x release exists at https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3.","how_to_check":"- Check the installed `@angular/router` version in `package-lock.json` or `yarn.lock`, or run `npm ls @angular/router`.\n- Confirm whether the app uses Angular Server-Side Rendering on Node.js.\n- Check whether the reverse proxy forwards URLs containing `;` and deep path segments to the SSR service.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["client-side-only","static-export","proxy-strips-semicolons"],"who_is_affected":"Only Angular applications that use server-side rendering on Node.js, where user-supplied request URLs are parsed by @angular/router during SSR. Client-side single page apps are not affected, and deployments behind a proxy that rejects semicolons or limits path depth reduce exposure. Versions 19.2.25 and older will not receive a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001042,"input_tokens":6487,"output_tokens":787,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101896':17A,25A '-2026':16A,24A '-400':32B '-770':34B '/a':149C,325C,510C '1':371C,609C '100':384C '11':242C,322C '12':356C '180':378C '2':229C,373C,524C,657C '20':232C,329C '20.3.32':585C '21.2.24':584C '22':357C '22.2.0':583C '25':235C,331C '2522':151C,219C,327C,516C '2522/a':512C,514C '256':362C '32':562C '350x':277C '400':656C '50':383C '512':364C '522':230C '740':344C '8':340C,349C '86qr':21A '90':377C '990':150C,216C,326C,511C,513C,515C '9cv3':22A 'achiev':269C,387C 'affect':429C 'alb':480C 'alloc':56B,186C,223C,252C,567C 'allow':281C 'amplif':273C,319C 'angular':1A,30B,43B,401C,642C 'angular/router':26A,27A,28A,29A,55B,103C,116C,466C,547C 'appli':597C 'applic':402C,405C,427C,442C 'approxim':276C 'array':59B,160C,189C,570C 'array-index':159C 'assign':208C 'asymmetr':271C 'attack':74B,259C,285C,422C,498C 'aw':627C 'back':60B,190C,202C,226C,571C 'bind':582C 'block':610C 'boundari':421C 'browser':413C 'buffer':351C 'burst':381C 'byte':243C,323C 'cannot':590C 'caus':90B,183C,220C,313C 'child':128C 'client':393C,399C 'client-sid':392C,398C 'cloudflar':479C,625C 'compon':580C 'concurr':337C,358C,385C,500C 'condit':436C 'configur':425C,619C 'consum':328C,532C 'consumpt':415C 'contain':483C,650C 'contigu':225C,569C 'control':460C 'craft':261C 'crash':76B,360C,539C 'cross':418C 'cve':15A,23A 'cwe':31B,33B 'default':347C 'denial':7A,91B,95C,315C 'dens':188C 'deriv':559C 'dictionari':205C,551C 'direct':455C 'dos':98C 'e.g':623C 'edg':605C 'element':193C,552C 'empti':181C 'enabl':111C,440C 'enforc':549C,658C 'engin':155C 'environ':450C 'error':89B,311C 'even':520C 'exampl':496C,647C 'example.com':519C 'exhaust':69B,287C,391C 'exploit':280C,494C 'extract':122C 'factor':274C 'fall':201C 'fatal':310C 'ff3f':20A 'filter':474C 'follow':217C,435C,601C 'forward':481C,638C 'frontend':41B 'get':509C 'ghsa':19A 'ghsa-ff3f-86qr-9cv3':18A 'heap':71B,238C,293C,306C,335C,390C,535C 'heurist':174C 'high':318C 'holey':192C 'host':518C 'http':501C,508C 'http/1.1':517C 'identifi':101C 'immedi':591C 'impact':278C 'incom':118C 'independ':255C 'index':161C,198C,561C 'initi':180C 'input':581C 'intern':170C 'interpret':156C 'issu':542C 'javascript':132C,154C,305C 'kb':233C,236C,330C,332C,341C,350C,372C,374C,525C 'key':177C,214C,560C 'larg':57B,212C 'like':215C 'limit':352C,662C 'local':412C 'low':336C 'make':54B 'match':576C 'matrix':13A,49B,125C,138C,266C,506C,613C,651C 'maximum':197C 'memori':88B,272C,309C,414C 'met':438C 'mib':363C,365C 'mitig':587C,602C 'moder':211C 'modest':64B,295C 'multipl':486C 'name':140C,143C,165C 'nginx':348C,478C,624C,645C,646C 'node.js':35B,47B,113C,289C,366C,453C 'npm':36B 'number':65B 'numer':11A,48B,145C,176C,213C,265C,505C,556C 'object':133C,182C,257C 'old':291C 'old-spac':290C 'one':598C 'out-of-memori':85B 'outlet':129C,142C 'overlap':526C 'overs':568C 'packag':37B 'page':404C 'paramet':14A,50B,126C,139C,256C,267C,507C,577C,614C,652C 'pars':117C,457C,464C 'patch':540C,595C 'path':123C,251C,343C,376C,487C,522C,636C,660C 'payload':495C 'plain':131C 'pointer':231C 'power':451C 'precondit':423C 'preserv':574C 'prevent':564C 'process':538C 'properti':162C,166C,172C 'property-storag':171C 'proxi':472C,477C,608C,618C,622C 'pure':397C 'rapid':531C 'rather':163C,199C 'record':134C 'reject':492C,630C,648C 'remot':284C 'render':5A,81B,108C,449C 'repeat':264C,504C 'request':52B,67B,119C,296C,342C,359C,375C,386C,461C,502C,527C,635C,639C,649C 'requir':338C 'resolv':544C 'return':655C 'revers':471C,476C,607C,617C,621C 'reverse-proxi':470C 'rout':575C 'router':456C 'run':45B,443C 'sanit':612C 'secur':420C 'segment':124C,244C,247C,324C,345C,379C,488C,661C 'semicolon':484C,633C 'semicolon/segment':473C 'send':499C 'sequenti':209C 'server':3A,79B,106C,447C 'server-sid':2A,78B,105C,446C 'servic':9A,93B,97C,317C,644C 'set':175C 'seturlderivedkey':554C 'side':4A,80B,107C,394C,400C,448C 'singl':241C,321C,403C 'size':194C 'smaller':370C 'space':292C 'spars':204C 'spas':395C 'specif':207C 'ssr':6A,38B,44B,109C,300C,367C,407C,439C,468C,529C,643C 'storag':173C,206C,553C 'store':61B,191C,227C,572C 'strict':659C 'string':135C,136C,146C 'strip':490C,632C 'success':279C 'termin':298C 'unaffect':396C 'unauthent':73B,283C 'unrecover':304C 'updat':546C 'upgrad':592C 'upstream':475C 'uri':654C 'url':12A,53B,120C,250C,262C,462C,482C,558C 'url-deriv':557C 'user':459C 'user-control':458C 'v8':58B,114C,153C,168C,184C,221C,334C,454C,534C,550C,565C 'valu':578C 'version':596C 'via':10A 'volum':297C 'vulner':99C,410C,424C 'waf':628C 'web':40B 'web-frontend':39B 'within':346C 'without':406C,489C 'workaround':586C 'worker':82B,301C,368C","nicknames":[],"mitigations":[],"who_affected":"Only Angular applications that use server-side rendering on Node.js, where user-supplied request URLs are parsed by @angular/router during SSR. Client-side single page apps are not affected, and deployments behind a proxy that rejects semicolons or limits path depth reduce exposure. Versions 19.2.25 and older will not receive a fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["router"],"ptokens":["angular","router"],"labels":["angular","cwe400","cwe770","high","nodejs","npm","package","ssr","webfrontend"],"campaign_type":null,"search_a":"'-101896':17A,25A '-2026':16A,24A '86qr':21A '9cv3':22A 'angular':1A 'angular/router':26A,27A,28A,29A 'cve':15A,23A 'denial':7A 'ff3f':20A 'ghsa':19A 'ghsa-ff3f-86qr-9cv3':18A 'matrix':13A 'numer':11A 'paramet':14A 'render':5A 'server':3A 'server-sid':2A 'servic':9A 'side':4A 'ssr':6A 'url':12A 'via':10A","search_b":"'-400':32B '-770':34B 'alloc':56B 'angular':30B,43B 'angular/router':55B 'array':59B 'attack':74B 'back':60B 'caus':90B 'crash':76B 'cwe':31B,33B 'denial':91B 'error':89B 'exhaust':69B 'frontend':41B 'heap':71B 'larg':57B 'make':54B 'matrix':49B 'memori':88B 'modest':64B 'node.js':35B,47B 'npm':36B 'number':65B 'numer':48B 'out-of-memori':85B 'packag':37B 'paramet':50B 'render':81B 'request':52B,67B 'run':45B 'server':79B 'server-sid':78B 'servic':93B 'side':80B 'ssr':38B,44B 'store':61B 'unauthent':73B 'url':53B 'v8':58B 'web':40B 'web-frontend':39B 'worker':82B","search_c":"'/a':149C,325C,510C '1':371C,609C '100':384C '11':242C,322C '12':356C '180':378C '2':229C,373C,524C,657C '20':232C,329C '20.3.32':585C '21.2.24':584C '22':357C '22.2.0':583C '25':235C,331C '2522':151C,219C,327C,516C '2522/a':512C,514C '256':362C '32':562C '350x':277C '400':656C '50':383C '512':364C '522':230C '740':344C '8':340C,349C '90':377C '990':150C,216C,326C,511C,513C,515C 'achiev':269C,387C 'affect':429C 'alb':480C 'alloc':186C,223C,252C,567C 'allow':281C 'amplif':273C,319C 'angular':401C,642C 'angular/router':103C,116C,466C,547C 'appli':597C 'applic':402C,405C,427C,442C 'approxim':276C 'array':160C,189C,570C 'array-index':159C 'assign':208C 'asymmetr':271C 'attack':259C,285C,422C,498C 'aw':627C 'back':190C,202C,226C,571C 'bind':582C 'block':610C 'boundari':421C 'browser':413C 'buffer':351C 'burst':381C 'byte':243C,323C 'cannot':590C 'caus':183C,220C,313C 'child':128C 'client':393C,399C 'client-sid':392C,398C 'cloudflar':479C,625C 'compon':580C 'concurr':337C,358C,385C,500C 'condit':436C 'configur':425C,619C 'consum':328C,532C 'consumpt':415C 'contain':483C,650C 'contigu':225C,569C 'control':460C 'craft':261C 'crash':360C,539C 'cross':418C 'default':347C 'denial':95C,315C 'dens':188C 'deriv':559C 'dictionari':205C,551C 'direct':455C 'dos':98C 'e.g':623C 'edg':605C 'element':193C,552C 'empti':181C 'enabl':111C,440C 'enforc':549C,658C 'engin':155C 'environ':450C 'error':311C 'even':520C 'exampl':496C,647C 'example.com':519C 'exhaust':287C,391C 'exploit':280C,494C 'extract':122C 'factor':274C 'fall':201C 'fatal':310C 'filter':474C 'follow':217C,435C,601C 'forward':481C,638C 'get':509C 'heap':238C,293C,306C,335C,390C,535C 'heurist':174C 'high':318C 'holey':192C 'host':518C 'http':501C,508C 'http/1.1':517C 'identifi':101C 'immedi':591C 'impact':278C 'incom':118C 'independ':255C 'index':161C,198C,561C 'initi':180C 'input':581C 'intern':170C 'interpret':156C 'issu':542C 'javascript':132C,154C,305C 'kb':233C,236C,330C,332C,341C,350C,372C,374C,525C 'key':177C,214C,560C 'larg':212C 'like':215C 'limit':352C,662C 'local':412C 'low':336C 'match':576C 'matrix':125C,138C,266C,506C,613C,651C 'maximum':197C 'memori':272C,309C,414C 'met':438C 'mib':363C,365C 'mitig':587C,602C 'moder':211C 'modest':295C 'multipl':486C 'name':140C,143C,165C 'nginx':348C,478C,624C,645C,646C 'node.js':113C,289C,366C,453C 'numer':145C,176C,213C,265C,505C,556C 'object':133C,182C,257C 'old':291C 'old-spac':290C 'one':598C 'outlet':129C,142C 'overlap':526C 'overs':568C 'page':404C 'paramet':126C,139C,256C,267C,507C,577C,614C,652C 'pars':117C,457C,464C 'patch':540C,595C 'path':123C,251C,343C,376C,487C,522C,636C,660C 'payload':495C 'plain':131C 'pointer':231C 'power':451C 'precondit':423C 'preserv':574C 'prevent':564C 'process':538C 'properti':162C,166C,172C 'property-storag':171C 'proxi':472C,477C,608C,618C,622C 'pure':397C 'rapid':531C 'rather':163C,199C 'record':134C 'reject':492C,630C,648C 'remot':284C 'render':108C,449C 'repeat':264C,504C 'request':119C,296C,342C,359C,375C,386C,461C,502C,527C,635C,639C,649C 'requir':338C 'resolv':544C 'return':655C 'revers':471C,476C,607C,617C,621C 'reverse-proxi':470C 'rout':575C 'router':456C 'run':443C 'sanit':612C 'secur':420C 'segment':124C,244C,247C,324C,345C,379C,488C,661C 'semicolon':484C,633C 'semicolon/segment':473C 'send':499C 'sequenti':209C 'server':106C,447C 'server-sid':105C,446C 'servic':97C,317C,644C 'set':175C 'seturlderivedkey':554C 'side':107C,394C,400C,448C 'singl':241C,321C,403C 'size':194C 'smaller':370C 'space':292C 'spars':204C 'spas':395C 'specif':207C 'ssr':109C,300C,367C,407C,439C,468C,529C,643C 'storag':173C,206C,553C 'store':191C,227C,572C 'strict':659C 'string':135C,136C,146C 'strip':490C,632C 'success':279C 'termin':298C 'unaffect':396C 'unauthent':283C 'unrecover':304C 'updat':546C 'upgrad':592C 'upstream':475C 'uri':654C 'url':120C,250C,262C,462C,482C,558C 'url-deriv':557C 'user':459C 'user-control':458C 'v8':114C,153C,168C,184C,221C,334C,454C,534C,550C,565C 'valu':578C 'version':596C 'volum':297C 'vulner':99C,410C,424C 'waf':628C 'within':346C 'without':406C,489C 'workaround':586C 'worker':301C,368C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-23T19:02:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-ff3f-86qr-9cv3","url":"https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3","severity":"high","published_at":"2026-09-23T19:02:54+00:00","modified_at":"2026-09-28T17:03:03+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","fetched_at":"2026-11-09T22:53:17+00:00","note":null},{"source":"ghsa","external_id":"GHSA-ff3f-86qr-9cv3","url":"https://github.com/advisories/GHSA-ff3f-86qr-9cv3","severity":"high","published_at":"2026-09-30T15:40:47+00:00","modified_at":"2026-09-30T15:40:48+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-101896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101896","severity":null,"published_at":"2026-10-14T16:17:29+00:00","modified_at":"2026-10-20T02:17:08+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110459,"url":"https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-23T19:02:54+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110790,"url":"https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110787,"url":"https://github.com/angular/angular/pull/70717","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110788,"url":"https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110789,"url":"https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110785,"url":"https://api.github.com/repos/angular/angular/security-advisories/GHSA-ff3f-86qr-9cv3","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":111142,"url":"https://github.com/angular/angular/releases/tag/v22.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111141,"url":"https://github.com/angular/angular/releases/tag/v21.2.24","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111140,"url":"https://github.com/angular/angular/releases/tag/v20.3.32","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00909,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101896"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}