Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-54268Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
High 8.2
In plain English
A high-severity uncontrolled resource consumption in angular from angular. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | angular.js | no fix listed | DEBIAN-CVE-2026-54268 |
| Debian:13 | angular.js | no fix listed | DEBIAN-CVE-2026-54268 |
| Ubuntu:22.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2026-54268 |
| Ubuntu:24.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2026-54268 |
| Ubuntu:25.10 | angular.js | no fix listed | UBUNTU-CVE-2026-54268 |
| Ubuntu:26.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2026-54268 |
| Ubuntu:26.10 | angular.js | no fix listed | UBUNTU-CVE-2026-54268 |
| npm | @angular/common | 20.3.25 | GHSA-48r7-hpm6-gfxm |
| npm | @angular/common | no fix listed | GHSA-48r7-hpm6-gfxm |
| npm | @angular/common | 21.2.17 | GHSA-48r7-hpm6-gfxm |
| npm | @angular/common | 22.0.1 | GHSA-48r7-hpm6-gfxm |
Affected products (as reported)
Weakness: CWE-400, CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm x_refsource_CONFIRM
- https://github.com/angular/angular/pull/69197 x_refsource_MISC
- https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd x_refsource_MISC