Vulnerabilities |
4 via 4 paths |
|---|---|
Dependencies |
38 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: @angular/router
- Introduced through: @angular/router@22.1.0
Detailed paths
-
Introduced through: angular-template@EmmanuelLefevre/AngularTemplate › @angular/router@22.1.0Remediation: Upgrade to @angular/router@22.2.0.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dense array backing store sized to the largest index, amplifying an 11 byte segment into 20 to 25 KB of heap. An attacker can exhaust the old space heap of a server side rendering worker and crash it with a JavaScript heap out of memory error, by sending requests whose paths repeat numeric matrix parameters, such as /a;990;2522/a;990;2522/, with 12 to 22 concurrent 8 KB paths sufficient against a 256 to 512 MiB worker. This requires server side rendering on Node.js with user controlled URLs reaching the router, so client side single page applications are unaffected, and it depends on no reverse proxy filtering semicolons or capping path segments ahead of the application.
Workaround
This vulnerability can be avoided by configuring the reverse proxy to reject or strip semicolons in request paths, or to enforce a limit of 20 to 30 path segments.
Remediation
Upgrade @angular/router to version 20.3.32, 21.2.24, 22.2.0 or higher.
References
high severity
new
- Vulnerable module: @angular/router
- Introduced through: @angular/router@22.1.0
Detailed paths
-
Introduced through: angular-template@EmmanuelLefevre/AngularTemplate › @angular/router@22.1.0Remediation: Upgrade to @angular/router@22.2.1.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the RouterLink directive's _urlTree computed signal, which permanently caches a UrlTree instance (including its cloned query parameter map and segment tree) in ReactiveNode.value for the lifetime of every <a routerLink> element in a view. During server-side rendering (SSR), each rendered link pins a full copy of the query parameter map in the heap. In an application with many links and large query parameter sets, this causes server workers to crash with an Out of Memory (OOM) error under concurrent load.
Note: This is only exploitable when the application is rendered server-side (SSR) and has a significant number of routerLink elements combined with large query parameter payloads or defaultQueryParamsHandling: 'merge' enabled.
Remediation
Upgrade @angular/router to version 22.2.1, 21.2.25 or higher.
References
high severity
new
- Vulnerable module: @angular/router
- Introduced through: @angular/router@22.1.0
Detailed paths
-
Introduced through: angular-template@EmmanuelLefevre/AngularTemplate › @angular/router@22.1.0Remediation: Upgrade to @angular/router@22.2.1.
Overview
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the router's URL recognition logic (recognize.ts and config_matching.ts) when processing empty-path outlet groups in a request URL (such as x:/(detail:2), ///(detail:2), or x:/()) that have no corresponding route in the route configuration. The four affected code paths - processChildren, processSegmentAgainstRoute, matchSegmentAgainstRoute, and noLeftoversInUrl - allow unmatched zero-segment outlet groups to bypass route validation, enabling an attacker to trigger unbounded recursive processing that exhausts available heap memory and crashes the server process.
Note: This is only exploitable when worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB-1 GiB).
Remediation
Upgrade @angular/router to version 20.3.33, 21.2.25, 22.2.1 or higher.
References
medium severity
- Vulnerable module: @angular/common
- Introduced through: @angular/common@22.1.0
Detailed paths
-
Introduced through: angular-template@EmmanuelLefevre/AngularTemplate › @angular/common@22.1.0Remediation: Upgrade to @angular/common@22.1.1.
Overview
Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache process. An attacker can access sensitive user-specific information by exploiting a scenario where a child HttpClient delegates requests to a parent client that injects authentication credentials, resulting in authenticated responses being cached and served to unauthorized users. This is only exploitable if all of the following conditions are met: Server-Side Rendering (SSR) with hydration is enabled, a hierarchical HttpClient configuration with withRequestsMadeViaParent() is used, authentication credentials are injected by a parent interceptor, and SSR HTML responses are cached by a shared caching layer (such as a CDN or reverse proxy).
Workaround
This vulnerability can be mitigated by attaching authentication credentials directly within the child client, applying explicit cache filters on the child client to exclude sensitive endpoints, or disabling HTTP transfer cache for routes handling user-authenticated data and ensuring SSR responses set appropriate cache-control headers.
Remediation
Upgrade @angular/common to version 20.3.28, 21.2.20, 22.1.1 or higher.