The vulnerability lies in how the Angular router parses numeric matrix parameter names and outlet names into empty JavaScript objects during Node.js server‑side rendering. V8 interprets these numeric keys as array indices, allocating unnecessarily large backing stores when the indices are high. Successive requests with overlapping numeric parameters can therefore consume disproportionate heap space, exhausting the old‑space heap and terminating the SSR worker. This leads to repeated downstream services becoming unavailable. The flaw is purely an out‑of‑band denial of service and does not grant any confidentiality or integrity benefits to an attacker.

Any application that uses @angular/router or angular:angular with server‑side rendering enabled and runs on Node.js is vulnerable if the installed versions are earlier than 20.3.32, 21.2.24, or 22.2.0. Pure client‑side Angular applications are unaffected. An attacker must be able to inject special URL segments containing semicolons and numeric matrix parameters, and the upstream proxy must permit those segments to reach the application.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is < 1 %, indicating a very low but non‑zero exploitation probability at the time of this analysis. The vulnerability is not listed in CISA KEV. The likely attack vector is remote unauthenticated requests directed at an SSR‑enabled Angular server that allows semicolons and multiple path segments in the URL. If such requests are repeatedly sent, the Node.js process will eventually crash, creating a denial‑of‑service condition for the application and any services depending on it.