The vulnerability is a denial‑of‑service attack caused by Angular’s server‑side rendering retaining attacker‑controlled query parameters in UrlTree instances. When an application uses queryParamsHandling set to merge or preserve during SSR, each rendered link can keep a copy of the query string. Overly large or many overlapping query strings can cause repeated memory allocations in the Node.js old‑space heap, eventually exhausting available memory and terminating the SSR worker, which leads to application downtime.

Any Angular application that uses server‑side rendering and runs versions 21.2.0 through 21.2.25 inclusive or 22.2.1 is affected. The vulnerability is present in the angular:angular platform and affects any deployment that exposes SSR endpoints to externally controlled query strings.

The CVSS score of 8.2 categorizes the issue as high severity, and its impact is a crash of SSR workers. The exploit relies on an attacker sending oversized or numerous query strings to a SSR endpoint. While the EPSS score is not available, the lack of a KEV listing indicates no confirmed exploits yet. Nonetheless, an attacker could trigger the resource exhaustion if upstream proxies or load balancers do not reject long query strings, making the vulnerability potentially exploitable in realistic network scenarios.