CVE-2026-54268: @angular/common Denial of Service (DoS) via OOM in Date Formatting
Summary
CVE-2026-54268: @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate). Affects @angular/common across 4 version ranges.
< 19.2.25
>= 20.0.0-next.0, < 20.3.25
>= 21.0.0-next.0, < 21.2.17
>= 22.0.0-next.0, < 22.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/common package is a core part of the Angular framework, providing essential functionalities for building web applications. It includes utilities for date formatting, among other features. However, a vulnerability has been identified in the formatDate function, which can lead to Denial of Service (DoS) attacks due to improper handling of input parameters.
Vulnerability Detail
A Denial of Service (DoS) vulnerability exists in the @angular/common package, specifically in the formatDate function. This function does not adequately limit or validate the length of the format parameter. An attacker can exploit this by supplying a maliciously crafted, excessively long date format string. The internal parser processes this string using a regular expression loop, leading to high CPU utilization and excessive memory consumption, ultimately causing the application to crash or become unresponsive. This vulnerability affects both Server-Side Rendering (SSR) and Client-Side Rendering (CSR) applications, making it critical to address.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/common@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/common@19.2.25 -
>= 20.0.0-next.0, < 20.3.2520.3.25npm install @angular/common@20.3.25 -
>= 21.0.0-next.0, < 21.2.1721.2.17npm install @angular/common@21.2.17 -
>= 22.0.0-next.0, < 22.0.122.0.1npm install @angular/common@22.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider validating the date format string before passing it to the formatDate function or DatePipe. Ensure that the format string is hardcoded or limited to a reasonable length to prevent exploitation.
Conclusion
The vulnerability CVE-2026-54268 in the @angular/common package poses a significant risk of Denial of Service due to improper handling of date format strings. It is crucial to update to the patched versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for @angular/common →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Exploiting this vulnerability can lead to Denial of Service (DoS), causing high CPU usage and memory exhaustion, which can crash the application or make it unresponsive.
Yes, the vulnerability affects all versions of @angular/common prior to the patched versions: 22.0.1, 21.2.17, and 20.3.25.
If you cannot update the package, implement input validation for the date format string to ensure it is not excessively long or derived from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/common.
