A malformed date format string supplied to the @angular/common formatDate function causes a regular‑expression loop that allocates memory without bounds. The resulting high CPU usage and excessive memory allocation can crash or hang an Angular application, denying service. This is a classic resource exhaustion flaw identified as CWE‑1333 and CWE‑400.

Angular applications using @angular/common prior to versions 22.0.1, 21.2.17, or 20.3.25 are affected. The vulnerability is present in the standard DatePipe as well. Any web front‑end built with these Angular releases that accepts user‑supplied format strings is potentially vulnerable.

The risk is moderate to high: the CVSS score is 8.2 and the exploitability is straightforward—any attacker can send an overly long format string to the client side and trigger the loop. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. As the DoS occurs client‑side, it can be triggered from any network channel that can reach the application’s front‑end.