The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL     parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty     JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array     indices and allocate dense backing stores sized to high numeric values, so repeated small path segments     cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping     requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the     request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the     Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not     affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0. (CVE-2026-101896)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-101896

high Nessus Plugin ID 366925

Version 1.2

Version 1.1

Version 1.2 Nov 10, 2026, 11:32 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611101132
Version 1.1 Oct 18, 2026, 5:28 AM New Plugin Feed: 202610180528