CVE-2026-101896: 
JavaScript vulnerability analysis and mitigation

CVE-2026-101896 is a Denial of Service (DoS) vulnerability in the @angular/router npm package affecting Angular applications running with Server-Side Rendering (SSR) on Node.js (V8). When the router parses incoming request URLs, numeric matrix parameter names or outlet names trigger V8's dense array backing store allocation (HOLEY_ELEMENTS), causing asymmetric memory amplification of approximately ~350x per URL segment. Affected versions include @angular/router >= 22.0.0 < 22.2.0, >= 21.0.0 < 21.2.24, >= 20.0.0 < 20.3.32, and <= 19.2.25. The vulnerability was discovered by researcher SkyZeroZx, reported on September 14, 2026, and published to the GitHub Advisory Database on September 30, 2026. It carries a CVSS v4 base score of 8.2 (High) (GitHub Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in packages/router/src/url_tree.ts. When @angular/router parses URL path segments, it stores matrix parameters and child outlet names as keys in plain JavaScript objects (Record<string, string>). V8's internal property-storage heuristics interpret numeric string keys (e.g., 990, 2522) as array indices, causing it to allocate a dense contiguous backing store (HOLEY_ELEMENTS) sized to the maximum index — approximately 20–25 KB of heap for a single 11-byte segment like /a;990;2522. Because each URL path segment allocates its own independent parameters object, an attacker can craft a URL with many repeated numeric matrix parameters to achieve ~350x memory amplification per request. The fix introduces a setUrlDerivedKey helper that forces V8 into dictionary (sparse) storage mode for numeric keys >= 32 by briefly setting and deleting a sentinel value (SLOW_ELEMENTS_SENTINEL = 0x40000000) before assigning the actual key (GitHub Advisory, Angular Commit).

Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap, terminating the SSR worker process with an unrecoverable "JavaScript heap out of memory" fatal error and causing a complete Denial of Service. With an 8 KB request path (~740 segments, within default Nginx 8 KB buffer limits), as few as 12–22 concurrent requests can crash a 256–512 MiB Node.js SSR worker. There is no confidentiality or integrity impact — the vulnerability is limited to availability of the SSR service. Pure client-side Angular Single Page Applications (SPAs) without SSR are not affected (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires no authentication, no user interaction, and has low attack complexity, though it does require the specific precondition that the target application uses Angular SSR with Node.js/V8 and that upstream reverse proxies do not strip semicolons from request paths. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. A reproduction lab was published by the discoverer (SkyZeroZx) at https://github.com/SkyZeroZx/angular-router-ssr-oom-lab (GitHub Advisory, Angular Issue).

1. Reconnaissance: Identify Angular SSR applications running on Node.js by examining HTTP response headers (e.g., X-Powered-By, server-side rendered HTML markers) or by probing known Angular SSR endpoints.
2. Verify proxy configuration: Confirm that the upstream reverse proxy (Nginx, Cloudflare, ALB) does not strip or reject semicolons (;) in request paths, as this is a required precondition for the attack to reach the Angular SSR worker.
3. Craft malicious URL: Construct a request URL with repeated numeric matrix parameters to maximize memory amplification, e.g.:

   GET /a;990;2522/a;990;2522/a;990;2522/[...repeated ~740 times to fill ~8 KB] HTTP/1.1
   Host: target.example.com

4. Send concurrent requests: Issue 12–22 concurrent HTTP requests with the crafted URL (for a 256–512 MiB Node.js heap). Each request causes the SSR worker to allocate ~20–25 KB of V8 heap per path segment, rapidly exhausting available memory.
5. Achieve DoS: Overlapping SSR processing of concurrent requests causes the Node.js process to terminate with a fatal "JavaScript heap out of memory" error, taking the SSR service offline (GitHub Advisory, Angular Issue).

• Network: Unusual HTTP GET requests containing long URL paths with repeated semicolon-delimited numeric segments (e.g., /a;990;2522/a;990;2522/...); high volume of concurrent requests to SSR endpoints from a small number of source IPs.
• Logs: Node.js process logs showing FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory; web server access logs with repeated requests to the same path pattern containing numeric matrix parameters (;[0-9]+) at high frequency.
• Process: Unexpected termination/restart of the Node.js SSR worker process; process monitoring alerts for the Angular SSR service crashing and restarting in rapid succession.
• Application: Sudden unavailability of server-side rendered pages while static assets remain accessible; increased memory usage visible in Node.js process metrics immediately preceding crashes (GitHub Advisory).

Upgrade @angular/router to a patched version: 22.2.0, 21.2.24, or 20.3.32. If immediate upgrade is not possible, apply one of the following reverse-proxy workarounds: (1) Configure Nginx or another reverse proxy to reject requests containing semicolons in the URI path (e.g., if ($uri ~* ";") { return 400; }); (2) Enforce strict path segment depth limits (e.g., reject requests with more than 20–30 path segments); (3) As a temporary measure only, increase the Node.js --max-old-space-size (e.g., to 2048 or 4096 MB) to raise the concurrency threshold required for heap exhaustion, though this does not eliminate the vulnerability. Upgrading to a patched version is the only complete remediation (GitHub Advisory).