SB2026091148 - Infinite loop in Angular

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091148

SB2026091148 - Infinite loop in Angular

Published: September 11, 2026

Security Bulletin ID SB2026091148
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the domino HTML parser when processing untrusted HTML containing an incomplete DOCTYPE declaration ending with whitespace before end of file. A remote attacker can submit a crafted incomplete DOCTYPE declaration to cause a denial of service.

The synchronous loop can starve the Node.js event loop and cause the server process to stop responding to requests.


Remediation

Install update from vendor's website.

References