CVE-2026-50171

Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

Published Jun 22, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Analysis

Technical impact

The flaw is located in Angular’s @angular/common package, specifically the internal formatNumber helper that is used by DecimalPipe, PercentPipe and CurrencyPipe. When a digitsInfo string specifies an extremely high number of fraction digits, the helper converts those values into integers and expands an internal digits array without any upper bound. This results in an unbounded loop that consumes a large amount of memory until the process crashes, causing a denial of service. The weakness is an input validation failure leading to uncontrolled resource consumption (CWE‑400, CWE‑834, CWE‑835).

Affected Systems

Applications that use Angular releases earlier than 22.0.0‑rc.2, 21.2.15, 20.3.22 or 19.2.23 and import the vulnerable @angular/common package are affected. Any UI component that formats numbers with DecimalPipe, PercentPipe or CurrencyPipe must verify that the installed version includes the fix.

Risk and Exploitability

With a CVSS score of 8.2, the vulnerability is considered high severity. The EPSS score is 0.00161, which represents a very low but non‑zero probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker supplying a malicious digitsInfo string through any user‑input interface that reaches the Angular formatter. The exploit requires no authentication or elevated privileges; the vulnerability operates solely on input validation failure. If such an input path exists, the DoS risk is immediate.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`>= 22.0.0-next.0, < 22.0.0-rc.2`	affected	—
`>= 21.0.0-next.0, < 21.2.15`	affected	—
`>= 20.0.0-next.0, < 20.3.22`	affected	—
`>= 19.0.0-next.0, < 19.2.23`	affected	—
`<= 18.2.14`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next0::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next1::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next10::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next11::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next12::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next2::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next3::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next4::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next5::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next6::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next7::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next8::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:next9::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:rc0::::node.js::*
	cpe:2.3:a:angular:angular:22.0.0:rc1::::node.js::*

No data.

Vendor Product Versions

Angular

Version	Status	Scheme	Platform
`[22.0.0-next.0,22.0.0-rc.2)`	affected	semver	—
`[21.0.0-next.0,21.2.15)`	affected	semver	—
`[20.0.0-next.0,20.3.22)`	affected	semver	—
`[19.0.0-next.0,19.2.23)`	affected	semver	—
`[0,18.2.14]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade @angular/common to a version that includes the patch (Angular 22.0.0‑rc.2 or newer, or 21.2.15, 20.3.22, 19.2.23).
Add validation for digitsInfo values to enforce reasonable bounds on the fraction digit count (e.g., limit to a maximum of 20).
Implement application‑level resource limits or monitoring to detect abnormal memory usage and restart affected components if necessary.

Generated by OpenCVE AI on June 30, 2026 at 01:56 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-p3vc-36g9-x9gr	@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.256% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr
https://nvd.nist.gov/vuln/detail/CVE-2026-50171
https://www.cve.org/CVERecord?id=CVE-2026-50171

History

Jun 30, 2026 12:45 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://nvd.nist.gov/vuln/detail/CVE-2026-50171 https://www.cve.org/CVERecord?id=CVE-2026-50171
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Jun 22, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Title		Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Weaknesses		CWE-400 CWE-834
References		https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`