Angular server‑side rendering fails to enforce matching of auxiliary outlet URL segments for empty‑path routes. Crafted requests containing multiple unconfigured empty‑path outlet groups repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route contains an empty‑path or named outlet, upstream infrastructure forwards the request, and the worker has a constrained heap. The allocation is transient and does not persist, so it does not affect client‑side SPAs or build‑time prerendering.

Angular framework, specifically any version of @angular/router running on Node.js server‑side rendering prior to 20.3.33, 21.2.25, or 22.2.1. Versions 20.3.33, 21.2.25, and 22.2.1 contain the fix.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no confirmed exploits are known yet. Nevertheless, the vulnerability requires SSR to be enabled, a route that contains an empty‑path or named outlet, and a worker with a constrained heap to be exploitable. The attack is likely to occur via crafted HTTP requests to the SSR endpoint, and the attacker does not need authentication.