A denial of service (DoS) vulnerability was identified in "@angular/router" when Server-Side Rendering (SSR) is enabled on Node.js (V8). When "@angular/router" parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects ("Record<string, string>"). When matrix parameter names or outlet names are numeric strings (such as "/a;990;2522"), the V8 JavaScript engine interprets them as array-indexed properties rather than named properties. Under V8's internal property-storage heuristics, setting numeric keys on an initially empty object causes V8 to allocate a dense array backing store ("HOLEY_ELEMENTS") sized to the maximum index rather than falling back to sparse dictionary storage. Specifically, assigning sequential or moderately large numeric keys (like "990" followed by "2522") causes V8 to allocate a contiguous backing store of ~2,522 pointers (~20 KB to 25 KB of heap) for a single 11-byte segment. Because each segment in a URL path allocates its own independent "parameters" object, an attacker can craft URLs with repeated numeric matrix parameters to achieve an asymmetric memory amplification factor of approximately ~350x.