CVE-2026-54268 - Vulnerability Details

- Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Published: 2026-06-22

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malformed date format string supplied to expression loop that allocates memory without bounds. The resulting high CPU usage and excessive memory allocation can crash or hang an Angular application, denying service. This is a classic resource exhaustion flaw identified as CWE-1333, CWE-400, and CWE-1284.

Affected Systems

Angular applications prior to 22.0.1, 21.2.17, or 20.3.25 are affected. The vulnerability is present in the standard DatePipe as well. Any web front‑end built with these Angular.

Risk and Exploitability

The risk is moderate to high: the CVSS score is 8.2 and the exploitability is straightforward—any attacker can send an overly long format string to the client side and trigger the loop. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. As the DoS occurs client‑side, it can be triggered from any network channel that can reach the application’s front‑end.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`>= 22.0.0-next.0 < 22.0.1`	affected	—
`>= 21.0.0-next.0 < 21.2.17`	affected	—
`>= 20.0.0-next.0 < 20.3.25`	affected	—
`<= 19.2.25`	affected	—

No data.

Vendor Product Confidence Versions

Angular

100%

Version	Status	Scheme	Platform
`[22.0.0-next.0,22.0.1)`	affected	semver	—
`[21.0.0-next.0,21.2.17)`	affected	semver	—
`[20.0.0-next.0,20.3.25)`	affected	semver	—
`[0,19.2.25]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Angular to 22.0.1, 21.2.17, or 20.3.25 – the versions that contain the fix for formatDate
If an upgrade cannot be performed immediately, implement size limits on format strings fed to DatePipe or formatDate, ensuring the string length does not exceed a safe threshold
Apply monitoring or rate limiting to detect and mitigate abnormal CPU usage spikes that may indicate an ongoing DoS attempt

Generated by OpenCVE AI on July 12, 2026 at 11:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-48r7-hpm6-gfxm	@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00331.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd
https://github.com/angular/angular/pull/69197
https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm
https://nvd.nist.gov/vuln/detail/CVE-2026-54268
https://www.cve.org/CVERecord?id=CVE-2026-54268

History

Thu, 09 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54268 https://www.cve.org/CVERecord?id=CVE-2026-54268
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Moderate`

Tue, 23 Jun 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 22 Jun 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Mon, 22 Jun 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Title		Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Weaknesses		CWE-1333 CWE-400
References		https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd https://github.com/angular/angular/pull/69197 https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Angular Angular

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-06-22T15:31:47.836Z

Updated: 2026-06-23T16:09:21.239Z

Reserved: 2026-06-12T17:13:32.279Z

Link: CVE-2026-54268

Vulnrichment

Updated: 2026-06-23T16:07:31.436Z

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-22T15:31:47Z

Links: CVE-2026-54268 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-12T11:15:16Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input
CWE-1333
Inefficient Regular Expression Complexity
CWE-400
Uncontrolled Resource Consumption

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object