{"id":"EUVD-2026-101126","enisaUuid":"ae215930-7040-3305-a243-de0993564c47","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.","datePublished":"Oct 14, 2026, 3:00:14 PM","dateUpdated":"Oct 14, 2026, 5:38:10 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7\nhttps://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25\nhttps://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567\nhttps://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f\nhttps://github.com/angular/angular/releases/tag/v20.3.31\nhttps://github.com/angular/angular/releases/tag/v21.2.23\nhttps://github.com/angular/angular/releases/tag/v22.1.6\n","aliases":"CVE-2026-101895\nGHSA-f67j-2jqw-jpq7\n","assigner":"GitHub_M","epss":0.87,"enisaIdProduct":[{"id":"0b342a06-57ef-332c-bd3a-5cdbea540a16","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"20.0.0, \u003c 20.3.31"},{"id":"408316ea-1359-315f-b5d8-53cc501b1ba5","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.6"},{"id":"84ef64cf-203d-3c48-99a0-831052d0d2d6","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.23"},{"id":"859b8f44-42ef-3862-a8ca-e94b5f3055e1","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"≤ 19.2.25"},{"id":"8b63c63d-7273-37a2-a3d0-43038fd67156","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"b27b6517-5058-30d2-bd59-573702c5534e","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"22.0.0, \u003c 22.1.6"},{"id":"ba48063b-6fb1-3bfe-9648-d85acccf0566","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"21.0.0, \u003c 21.2.23"},{"id":"f401b271-87e4-33cb-ba1a-6677550bd8a4","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.31"}],"enisaIdVendor":[{"id":"2159dec4-b8bd-3faa-8468-4fe5b33d9dba","vendor":{"name":"@angular/"}},{"id":"52be7d2f-0575-3866-8260-cad88e91671c","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"5f74ea10-4c5a-3490-bd9f-315e72d42d25","vulnerability":{"id":"GHSA-f67j-2jqw-jpq7","description":"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE","datePublished":"Sep 28, 2026, 9:31:21 PM","dateUpdated":"Sep 28, 2026, 9:31:21 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7\nhttps://github.com/angular/angular\n","enisa_id":"EUVD-2026-101126\n","aliases":"CVE-2026-101895\nGHSA-f67j-2jqw-jpq7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"724c72c9-6039-3f16-a22e-5686c11440cb","vulnerability":{"id":"CVE-2026-101895","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.","datePublished":"Oct 14, 2026, 3:00:14 PM","dateUpdated":"Oct 14, 2026, 5:38:10 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7\nhttps://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25\nhttps://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567\nhttps://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f\nhttps://github.com/angular/angular/releases/tag/v20.3.31\nhttps://github.com/angular/angular/releases/tag/v21.2.23\nhttps://github.com/angular/angular/releases/tag/v22.1.6\n","enisa_id":"EUVD-2026-101126\n","assigner":"GitHub_M","epss":0.87,"dataProcessed":"Nov 6, 2026, 7:16:26 AM","vulnerabilityProduct":[{"id":"028023db-ce5d-335e-9766-639281972d99","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"22.0.0, \u003c 22.1.6"},{"id":"12b860cb-d3e1-396f-b14a-63033e9aaa7e","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.23"},{"id":"1aee0281-655b-3556-bab9-80b1866303fb","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"≤ 19.2.25"},{"id":"2e309751-2969-3c6a-bbd2-d3642422ab2e","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.6"},{"id":"473787b5-0361-3603-b556-c986454c0a44","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"21.0.0, \u003c 21.2.23"},{"id":"7c8f1738-db82-342e-ab36-ac89ffe2d83f","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"9d86f965-8453-3d59-ac04-6cd90f5fc82d","product":{"name":"platform-server","vendor":{"name":"@angular"}},"product_version":"20.0.0, \u003c 20.3.31"},{"id":"c456ad89-034b-326e-b98b-174ad2a6b5e4","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.31"}],"vulnerabilityVendor":[{"id":"0405ebba-4ea9-3b04-abe0-3db5375da4bf","vendor":{"name":"angular"}},{"id":"e2a0aba6-2a65-3d54-85bc-c3537b9a6a30","vendor":{"name":"@angular/"}}]}}],"enisaIdAdvisory":[]}