CVE-2026-101895

Name of the Vulnerable Software and Affected Versions @angular/platform-server (affected versions not specified)

Description A Denial of Service (DoS) issue exists in the DOM emulation parser (domino) used by @angular/platform-server for Server-Side Rendering (SSR). When the parser processes untrusted HTML containing an incomplete DOCTYPE declaration that ends with whitespace before the end of the file (EOF), such as <!DOCTYPE html , it enters an infinite synchronous loop. This occurs because the EOF handling branch in the after doctype name state state of the lib/HTMLParser.js file emits tokens without advancing the character index pointer nextchar. Consequently, the scanner loop repeatedly invokes the state handler, causing CPU utilization to reach 100% and freezing the Node.js server process. This is reachable in applications where untrusted user input is bound to [innerHTML], interpolated into markup, or sanitized on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid binding untrusted user input directly to [innerHTML] in server-rendered templates, using standard text interpolation or [textContent] instead. Validate or sanitize user input before passing it to [innerHTML] on the server by stripping or rejecting strings matching /^<!DOCTYPE/i.