An attacker can supply malformed HTML that ends an incomplete DOCTYPE with whitespace to Angular’s server-side rendering engine. The DOM emulation parser in @angular/platform-server then enters an infinite synchronous loop, repeatedly processing the same EOF token. The result is a complete CPU exhaustion of the Node.js SSR worker, starving the event loop and blocking subsequent and concurrent HTTP requests. This vulnerability is a classic input validation flaw and an infinite loop, reflected in CWE‑400 and CWE‑835. It has no remote code execution implications but can crash or heavily degrade application availability.

The vulnerability affects the Angular platform-server module in all releases prior to 20.3.31, 21.2.23, and 22.1.6. Updating Angular to version 20.3.31 or later (or 21.2.23/22.1.6) eliminates the issue.

The CVSS score of 8.7 places the flaw in the high severity range, and with an EPSS score of 0.00716—a very low but non‑zero exploitation probability—the nature of the bug—an unbounded loop triggered by unauthenticated input—makes it a realistic DoS vector. The vulnerability is not listed in CISA’s KEV catalog, but a remote attacker can exploit it via any SSR route that parses attacker‑controlled HTML, such as innerHTML bindings. The impact is localized to the owner of the SSR worker, but the full CPU consumption can bring down the entire Node.js application if no worker isolation or load balancing is in place.