CVE-2026-101895 · GHSA-f67j-2jqw-jpq7

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Risk score: 78/100
CVSS: 8.7 v4.0
Exploit chance (30 days): 0.7%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-contr…
Affected: @angular/platform-server (npm) >= 22.0.0, < 22.1.6; @angular/platform-server (npm) >= 21.0.0, < 21.2.23; @angular/platform-server (npm) >= 20.0.0, < 20.3.31; @angular/platform-server (npm) <= 19.2.25
Fix: Upgrade @angular/platform-server to 22.1.6 or 21.2.23 or 20.3.31 (whichever matches your release line) or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@angular/platform-server: Amber, patch this week. Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-contr…

The flaws

CVE-2026-101895: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVSS 8.7 · EPSS 1%)
CVE-2026-88058: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (CVSS 8.6 · EPSS 0%)

The fix

Upgrade @angular/platform-server: 20.3.31 · 21.2.23 · 22.1.6 or later on your release line

Who is exposed: @angular/platform-server (npm) >= 22.0.0, < 22.1.6; @angular/platform-server (npm) >= 21.0.0, < 21.2.23; @angular/platform-server (npm) >= 20.0.0, < 20.3.31; @angular/platform-server (npm) <= 19.2.25

Where it stands

Public proof of concept

Connects to

Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days

Why it is Amber

CVSS 8.7 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@angular/platform-server	npm	>= 22.0.0, < 22.1.6	22.1.6
@angular/platform-server	npm	>= 21.0.0, < 21.2.23	21.2.23
@angular/platform-server	npm	>= 20.0.0, < 20.3.31	20.3.31
@angular/platform-server	npm	<= 19.2.25	No fix yet

References

Original description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

Last activity 28 Sep 2026. Patch Forecast updates every hour.