Infinite loop in Angular - #VU149012
Published: September 11, 2026
Vulnerability identifier: #VU149012
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop in the domino HTML parser when processing untrusted HTML containing an incomplete DOCTYPE declaration ending with whitespace before end of file. A remote attacker can submit a crafted incomplete DOCTYPE declaration to cause a denial of service.
The synchronous loop can starve the Node.js event loop and cause the server process to stop responding to requests.
Affected software
Angular
Remediation
Install security update from vendor's website.
Angular - addressed in versions 20.3.31, 21.2.23, 22.1.6