CVE-2026-54268

Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Published Jun 22, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Analysis

Technical impact

A malformed date format string supplied to Angular's formatDate function causes the internal parser to split the string with an iterative regular expression loop. The loop does not enforce a maximum length or proper validation, so the application can consume excessive memory and CPU resources, eventually crashing the client side or rendering the page unresponsive. This constitutes a classic resource exhaustion flaw.

Affected Systems

Any Angular application built with the Angular framework before 22.0.1, 21.2.17, or 20.3.25 is affected, specifically the @angular/common package and the standard DatePipe that internally calls formatDate.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity. The EPSS score of < 1 % reflects a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a client‑side request in which an attacker supplies an excessively long format string to a page utilizing DatePipe or formatDate; no elevated privileges are required. When triggered, the resulting high CPU usage and memory allocation can deny service to all users sharing the affected resource.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

angular

affected

Version	Status	Constraints
`>= 22.0.0-next.0 < 22.0.1`	affected	—
`>= 21.0.0-next.0 < 21.2.17`	affected	—
`>= 20.0.0-next.0 < 20.3.25`	affected	—
`<= 19.2.25`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*
	cpe:2.3:a:angular:angular::::::node.js::*

No data.

Vendor Product Versions

Angular

Version	Status	Scheme	Platform
`[22.0.0-next.0,22.0.1)`	affected	semver	—
`[21.0.0-next.0,21.2.17)`	affected	semver	—
`[20.0.0-next.0,20.3.25)`	affected	semver	—
`[0,19.2.25]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Angular to 22.0.1, 21.2.17, or 20.3.25 to apply the fix for formatDate
If an upgrade cannot be performed immediately, enforce a length limit on any format string passed to formatDate or DatePipe, ensuring it never exceeds a safe threshold to mitigate resource exhaustion
Implement application‑level monitoring for abnormal CPU spikes or memory growth that could indicate an ongoing DoS attack

Generated by OpenCVE AI on August 2, 2026 at 01:36 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-48r7-hpm6-gfxm	@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.583% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd
https://github.com/angular/angular/pull/69197
https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm
https://nvd.nist.gov/vuln/detail/CVE-2026-54268
https://www.cve.org/CVERecord?id=CVE-2026-54268

History

Jul 9, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54268 https://www.cve.org/CVERecord?id=CVE-2026-54268
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Moderate`

Jun 23, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 6:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Angular Angular angular
Vendors & Products		Angular Angular angular

Jun 22, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Title		Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Weaknesses		CWE-1333 CWE-400
References		https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd https://github.com/angular/angular/pull/69197 https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`