Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-     server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering     processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of     input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without     advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF     marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths     such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop     concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
    (CVE-2026-101895)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.31, 21.x prior to 21.2.23 or 22.x prior to 22.1.6. It is, therefore, affected by a denial of service vulnerability in the DOM emulation parser (domino) of @angular/platform-server. Processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF causes an infinite loop, freezing the Node.js server process. (CVE-2026-101895)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-
    server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering
    processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of
    input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without
    advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF
    marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths
    such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop
    concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
    (CVE-2026-101895)

ID	Name	Product	Family	Type	Severity
366927	Linux Distros Unpatched Vulnerability : CVE-2026-101895	Nessus	Misc.	Local	high
115576	Angular < 20.3.31 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
115575	Angular 20.x < 20.3.31 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
115574	Angular 21.x < 21.2.23 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
115573	Angular 22.x < 22.1.6 Denial of Service	Web App Scanning	Component Vulnerability	Version Based	high
448443	SCA: security update for @angular/platform-server (GHSA-f67j-2jqw-jpq7)	Tenable Cloud Security	SCA Checks	Local	high
448443	SCA: security update for @angular/platform-server (GHSA-f67j-2jqw-jpq7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-101895

high

Tenable Plugins

high

high

high

high

high

high

high