CVE-2026-101896: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript

This month

HIGH 8.2REMOTE

CVE-2026-101896 is a high-severity flaw (CVSS 8.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores size

Why this priority

High severity
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	8.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.8% (top 45%)
CISA exploited list	No
Weakness	CWE-400, CWE-770
Published	2026-10-14
Last modified	2026-10-20

Publisher (CNA): GitHub, Inc.

Last updated 2026-10-20 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-10-14 16:17 UTCPublished CVE record published
2026-10-20 02:17 UTCUpdated Record last modified

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-101896?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-101896 being exploited?

CVE-2026-101896 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-101896 affect?

CVE-2026-101896 affects affected software. Severity is high (CVSS 8.2). Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names

How urgent is CVE-2026-101896?

Priority 47/100. High severity; Remotely exploitable, no login, no user action

Software pages

Node.js vulnerabilities · Angular vulnerabilities

References

← Back to latest CVEs