renovate-bot opened a new pull request, #8810: URL: https://github.com/apache/texera/pull/8810
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/router](https://redirect.github.com/angular/angular/tree/main/packages/router) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/router)) | [`21.2.18` → `21.2.24`](https://renovatebot.com/diffs/npm/@angular%2frouter/21.2.18/21.2.24) |  |  | --- ### Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters [CVE-2026-101896](https://nvd.nist.gov/vuln/detail/CVE-2026-101896) / [GHSA-ff3f-86qr-9cv3](https://redirect.github.com/advisories/GHSA-ff3f-86qr-9cv3) <details> <summary>More information</summary> #### Details A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8). When `@angular/router` parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects (`Record<string, string>`). When matrix parameter names or outlet names are numeric strings (such as `/a;990;2522`), the V8 JavaScript engine interprets them as array-indexed properties rather than named properties. Under V8's internal property-storage heuristics, setting numeric keys on an initially empty object causes V8 to allocate a dense array backing store (`HOLEY_ELEMENTS`) sized to the maximum index rather than falling back to sparse dictionary storage. Specifically, assigning sequential or moderately large numeric keys (like `990` followed by `2522`) causes V8 to allocate a contiguous backing store of ~2,522 pointers (~20 KB to 25 KB of heap) for a single 11-byte segment. Because each segment in a URL path allocates its own independent `parameters` object, an attacker can craft URLs with repeated numeric matrix parameters to achieve an asymmetric memory amplification factor of approximately **~350x**. ##### Impact Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest request volume, terminating the SSR worker with an unrecoverable `JavaScript heap out of memory` fatal error and causing a Denial of Service. * **High Amplification:** A single 11-byte segment (`/a;990;2522`) consumes ~20 KB–25 KB of V8 heap. * **Low Concurrency Required:** * With 8 KB request paths (~740 segments, within default Nginx 8 KB buffer limits), as few as **12–22 concurrent requests** crash a 256 MiB–512 MiB Node.js SSR worker. * With smaller 1 KB–2 KB request paths (~90–180 segments), a burst of ~50–100 concurrent requests achieves the same heap exhaustion. * **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are **not** vulnerable, as local browser memory consumption does not cross a security boundary. ##### Attack Preconditions & Vulnerable Configurations An application is affected only if **all** of the following conditions are met: * **SSR Enabled:** The application runs in a Server-Side Rendering environment powered by Node.js / V8. * **Direct Router Parsing:** User-controlled request URLs are parsed by `@angular/router` during SSR. * **No Reverse-Proxy Semicolon/Segment Filtering:** Upstream reverse proxies (Nginx, Cloudflare, ALB) forward URLs containing semicolons (`;`) and multiple path segments without stripping or rejecting them. ##### Exploit Payload Example An attacker sends concurrent HTTP requests with repeated numeric matrix parameters: ```http GET /a;990;2522/a;990;2522/a;990;2522/... HTTP/1.1 Host: example.com ``` Even with paths under 2 KB, overlapping requests during SSR will rapidly consume the V8 heap until the process crashes. ##### Patches The issue is resolved by updating `@angular/router` to enforce V8 dictionary elements storage (`setUrlDerivedKey`) for numeric URL-derived keys (index >= 32). This prevents V8 from allocating oversized contiguous array backing stores while preserving route matching, parameter values, and component input bindings. * `22.2.0` * `21.2.24` * `20.3.32` ##### Workarounds & Mitigations If you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge or reverse proxy: 1. **Block or Sanitize Matrix Parameters at the Reverse Proxy:** Configure your reverse proxy (e.g., Nginx, Cloudflare, or AWS WAF) to reject or strip semicolons (`;`) in request paths before forwarding requests to the Angular SSR service: ```nginx # Nginx example: reject requests containing matrix parameters if ($uri ~* ";") { return 400; } ``` 2. **Enforce Strict Path Segment Limits:** Reject requests with excessive path depth (e.g., more than 20–30 segments). 3. **Increase Node.js Old Space:** Increase `--max-old-space-size` (e.g., to 2048 or 4096 MB) to increase the concurrency threshold required to exhaust memory, though this does not fully eliminate the vulnerability under sustained traffic. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3](https://redirect.github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3) - [https://github.com/angular/angular/issues/70716](https://redirect.github.com/angular/angular/issues/70716) - [https://github.com/angular/angular/pull/70717](https://redirect.github.com/angular/angular/pull/70717) - [https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583](https://redirect.github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583) - [https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d](https://redirect.github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d) - [https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4](https://redirect.github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-ff3f-86qr-9cv3) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>angular/angular (@​angular/router)</summary> ### [`v21.2.24`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21224-2026-09-23) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.23...v21.2.24) ##### router | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ---------------------------------------------------- | | [03872a80bc](https://redirect.github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583) | fix | avoid dense elements allocation for numeric URL keys | <!-- CHANGELOG SPLIT MARKER --> ### [`v21.2.23`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21223-2026-09-09) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.22...v21.2.23) ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- | | [fc2e8fbc0b](https://redirect.github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> ### [`v21.2.22`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21222-2026-08-26) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.21...v21.2.22) ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------- | | [5aa6d97deb](https://redirect.github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132) | fix | avoid stripping unicode whitespace during url resolution | | [73d8bbd27c](https://redirect.github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> ### [`v21.2.21`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21221-2026-08-19) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.20...v21.2.21) ##### platform-browser | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ----------------------------------------- | | [c19a36c2fb](https://redirect.github.com/angular/angular/commit/c19a36c2fbc51f41ce974ea1fd87f9f56b3e2444) | fix | disallow event handler attributes in Meta | <!-- CHANGELOG SPLIT MARKER --> ### [`v21.2.20`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21220-2026-08-12) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.19...v21.2.20) ##### core | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ---------------------------------------- | | [6afe6fa781](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) | fix | sanitize host bindings on concrete hosts | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | --------------------------------------------------- | | [fec5977df4](https://redirect.github.com/angular/angular/commit/fec5977df4dda3a10d5ce2923e3e06d86ba11ee7) | fix | match header values exactly when deleting | | [e33d69a71c](https://redirect.github.com/angular/angular/commit/e33d69a71c5beb8fe5785b53fd6b37658334e8e0) | fix | preserve immutability of materialized clones | | [caf616670f](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d) | fix | run root interceptors in the terminal request chain | <!-- CHANGELOG SPLIT MARKER --> ### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19) ##### compiler | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- | | [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes | | [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ | | [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params | | [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient | ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- | | [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZWxlYXNlL3YxLjIiLCJzZWN1cml0eSJdfQ==--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
