A malformed date format string supplied to Angular's formatDate function causes the internal parser to split the string with an iterative regular expression loop. The loop does not enforce a maximum length or proper validation, so the application can consume excessive memory and CPU resources, eventually crashing the client side or rendering the page unresponsive. This constitutes a classic resource exhaustion flaw.

Any Angular application built with the Angular framework before 22.0.1, 21.2.17, or 20.3.25 is affected, specifically the @angular/common package and the standard DatePipe that internally calls formatDate.

The CVSS score of 8.2 indicates a high severity. The EPSS score of < 1 % reflects a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a client‑side request in which an attacker supplies an excessively long format string to a page utilizing DatePipe or formatDate; no elevated privileges are required. When triggered, the resulting high CPU usage and memory allocation can deny service to all users sharing the affected resource.