{"metadata": {"vulnerability": "CVE-2026-101895", "count": 14, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-09T20:36:09Z", "date_only": false, "value": "2026-09-09T20:36:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7", "record": "CVE-2026-101895", "field": "creation_timestamp", "uuid": "85c10649-6564-4a1e-8178-239868dd30fa", "url": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7"}, {"timestamp": "2026-09-28T15:55:37.906Z", "date_only": false, "value": "2026-09-28T15:55:37.906Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-101895", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-28T21:31:21Z", "date_only": false, "value": "2026-09-28T21:31:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F67J-2JQW-JPQ7", "record": "GHSA-F67J-2JQW-JPQ7", "field": "published"}, {"timestamp": "2026-09-28T21:31:21Z", "date_only": false, "value": "2026-09-28T21:31:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F67J-2JQW-JPQ7", "record": "GHSA-F67J-2JQW-JPQ7", "field": "modified"}, {"timestamp": "2026-10-14T15:00:14.385Z", "date_only": false, "value": "2026-10-14T15:00:14.385Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-101895", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T15:00:14.385Z", "date_only": false, "value": "2026-10-14T15:00:14.385Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-101895", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:03.370Z", "date_only": false, "value": "2026-10-14T15:17:03.370", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101895", "record": "FKIE_CVE-2026-101895", "field": "published"}, {"timestamp": "2026-10-14T17:37:35.859Z", "date_only": false, "value": "2026-10-14T17:37:35.859234Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-101895", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T17:37:35.859Z", "date_only": false, "value": "2026-10-14T17:37:35.859234Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101895", "record": "FKIE_CVE-2026-101895", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T17:38:10.017Z", "date_only": false, "value": "2026-10-14T17:38:10.017Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-101895", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:38:10.017Z", "date_only": false, "value": "2026-10-14T17:38:10.017Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-101895", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T20:23:54.295Z", "date_only": false, "value": "2026-10-14T20:23:54.295278Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441130249376980", "record": "CVE-2026-101895", "field": "creation_timestamp", "uuid": "8cb3a8d8-3e1f-4a26-82e5-1eba864f5252", "content": "CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.\nhttps://www.cve.org/CVERecord?id=CVE-2026-101895https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6fhttps://github.com/angular/angular/releases/tag/v20.3.31https://github.com/angular/angular/releases/tag/v21.2.23https://github.com/angular/angular/releases/tag/v22.1.6#angular #@angular/ #platform-server#CVE_2026_101895#bot", "url": "https://infosec.exchange/users/cve/statuses/117441130249376980"}, {"timestamp": "2026-10-16T00:45:06Z", "date_only": false, "value": "2026-10-16T00:45:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/angular-disponibile-poc-per-lo-sfruttamento-delle-cve-2026-101895-e-cve-2026-101896", "record": "CVE-2026-101895", "field": "creation_timestamp", "uuid": "26f6ab27-cb4f-42db-949e-1b489d828255", "url": "https://www.acn.gov.it/portale/w/angular-disponibile-poc-per-lo-sfruttamento-delle-cve-2026-101895-e-cve-2026-101896"}, {"timestamp": "2026-10-16T16:00:33.533Z", "date_only": false, "value": "2026-10-16T16:00:33.533", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101895", "record": "FKIE_CVE-2026-101895", "field": "lastModified"}]}