CVE-2026-101895: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-101895 is a Denial of Service (DoS) vulnerability in @angular/platform-server's DOM emulation parser (domino), triggered by malformed DOCTYPE declarations in Angular Server-Side Rendering (SSR) applications. When processing untrusted HTML input containing an incomplete DOCTYPE declaration ending with whitespace before EOF (e.g., <!DOCTYPE html ), the HTML parser enters an infinite synchronous loop, pegging CPU at 100% and freezing the Node.js server process. Affected versions include @angular/platform-server >= 22.0.0 < 22.1.6, >= 21.0.0 < 21.2.23, >= 20.0.0 < 20.3.31, and all versions <= 19.2.25 (end-of-life, will not be patched). It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Angular Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In Domino's HTML parser (lib/HTMLParser.js), tokenizer states with fixed lookahead — such as after_doctype_name_state (lookahead = 6) — rely on the state handler to advance the character index pointer (nextchar). While branches for whitespace, >, and keyword matching correctly advance nextchar, the EOF branch (case -1: // EOF) emits doctype and EOF tokens without advancing nextchar or transitioning state, causing the scanner loop (while (nextchar < numchars)) to re-invoke the same state indefinitely. Because Node.js is single-threaded, this synchronous infinite loop completely starves the event loop. The vulnerability is reachable wherever untrusted user input is bound via [innerHTML], interpolated into markup, or sanitized server-side in an Angular SSR application (GitHub Advisory, Angular Advisory).

Successful exploitation allows an unauthenticated remote attacker to immediately freeze the Node.js server process by sending a single crafted HTTP request containing a malformed DOCTYPE payload. The server's CPU is pegged at 100% and the event loop is completely starved, rendering the application unresponsive to all subsequent requests. There is no confidentiality or integrity impact, but availability is fully compromised for the duration of the attack; the server must be restarted to recover (GitHub Advisory, Angular Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, and is exploitable over the network with low attack complexity, making it trivially weaponizable once a PoC is developed. The CVE status is currently "Reserved" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Angular SSR applications (using @angular/platform-server) exposed over the network. Look for server-rendered Angular apps that accept and reflect user-controlled HTML input via [innerHTML] bindings, interpolation, or DOM APIs.
2. Craft the payload: Construct an HTTP request body or query parameter containing an incomplete DOCTYPE declaration ending with whitespace before EOF, such as <!DOCTYPE html (no closing >).
3. Deliver the payload: Submit the crafted input to any endpoint in the Angular SSR application that processes untrusted HTML server-side — for example, a form field, URL parameter, or API body that feeds into a template binding like [innerHTML].
4. Trigger the infinite loop: The domino parser's after_doctype_name_state handler encounters EOF without advancing nextchar, causing the scanner loop to spin indefinitely in a synchronous context.
5. Achieve DoS: The Node.js event loop is completely starved; the server stops responding to all requests and CPU utilization reaches 100%. The server must be manually restarted to recover (GitHub Advisory, Angular Advisory).

• Process: Node.js server process sustaining 100% CPU utilization with no corresponding increase in legitimate traffic; process becomes unresponsive and stops handling new connections.
• Logs: Application logs showing a sudden cessation of request processing after a specific inbound request; absence of response log entries following the triggering request.
• Network: Inbound HTTP requests containing HTML bodies or parameters with the string <!DOCTYPE followed by whitespace and no closing >; repeated requests of this pattern from the same source IP may indicate automated probing.
• Availability: Complete loss of HTTP response from the Angular SSR application; health check endpoints become unreachable; downstream monitoring alerts for service unavailability (GitHub Advisory).

Update @angular/platform-server to a patched version: 22.1.6, 21.2.23, or 20.3.31. Angular versions 19.x and below are end-of-life and will not receive a patch; users on these versions should upgrade to a supported major version. As interim mitigations, implement server-side input validation to reject or normalize malformed DOCTYPE declarations before they reach the HTML parser, and deploy request timeout mechanisms and rate limiting to detect and interrupt runaway server processes. Consider using a reverse proxy or WAF to filter requests containing suspicious DOCTYPE patterns (GitHub Advisory, Angular Advisory).

HeroDevs published a blog post and vulnerability directory entry specifically noting that Angular versions 5 through 19 have no fix available due to end-of-life status, highlighting the risk for organizations on older Angular versions (HeroDevs Blog). Tenable added detection coverage for the vulnerability in both its cloud security and web application scanning plugins shortly after disclosure (Tenable).