GHSA-f67j-2jqw-jpq7 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

• npm @angular/platform-server: >= 22.0.0, < 22.1.6 → fixed in 22.1.6 • npm @angular/platform-server: >= 21.0.0, < 21.2.23 → fixed in 21.2.23 • npm @angular/platform-server: >= 20.0.0, < 20.3.31 → fixed in 20.3.31 • npm @angular/platform-server: <= 19.2.25 (no fix yet)

A Denial of Service (DoS) vulnerability exists in `@angular/platform-server`'s DOM emulation parser (`domino`). When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF (such as ``, and keyword matching advance `nextchar`, the EOF branch (`case -1: // EOF`) emitted doctype and EOF tokens without advancing `nextchar` or transitioning out of the state: ```javascript case -1: // EOF forcequirks(); emitDoctype(); emitEOF(); break; ``` Because `nextchar` remained unchanged pointing to the EOF marker character (`\uFFFF`), the scanner loop (`while (nextchar `, }) export class AppComponent { // Attacker-controlled input containing an incomplete DOCTYPE ending with whitespace payload = '<!DOCTYPE html '; } ``` Workarounds • Avoid binding untrusted user input directly to `[innerHTML]` in server-rendered templates; use standard text interpolation (`{{ userInput }}`) or `[textContent]` when raw HTML rendering is not required. • Validate or sanitize user input before passing it to `[innerHTML]` on the server by stripping or rejecting strings matching `/^<!DOCTYPE/i`.