A denial of service (DoS) vulnerability was identified in "@angular/router" when Server-Side Rendering (SSR) is enabled on Node.js (V8) and "RouterLink" directives are rendered with "queryParamsHandling: 'merge'" or "'preserve'", configured either per link or globally via "defaultQueryParamsHandling". Starting in v21.2.0 ("angular/angular#66181" (https://github.com/angular/angular/pull/66181)), "RouterLink" internals were refactored to use signals, introducing a computed signal ("_urlTree") that cached the returned "UrlTree" instance on the directive. Because each rendered link maintains an active "RouterLink" instance for the entire duration of the request lifecycle, the computed signal permanently pinned the "UrlTree" and its associated query parameter dictionary in the heap until the SSR response completed. When query parameter handling is set to "'merge'" or "'preserve'", each link copies the incoming request's query parameters into its own "UrlTree". During SSR, memory consumption scales multiplicatively: $$\text{Heap Retention} \approx (\text{Number of affected links}) \times (\text{Size of parsed query parameter map})$$ Because parsed JavaScript objects and property dictionaries require substantially more heap space than the raw query string—particularly when property names trigger dense array allocations under V8 property-storage heuristics—an attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.