CVE-2026-54268 Details
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
A denial-of-service vulnerability has been identified in the @angular/common package of the Angular framework, affecting versions prior to 22.0.1, 21.2.17, 20.3.25, and 19.2.25. The issue arises in the formatDate function, which is also used by the standard Angular DatePipe. The vulnerability stems from improper validation of the format parameter, allowing for excessively long date format strings to be parsed. This leads to high CPU usage and excessive memory allocations, causing application crashes or unresponsiveness. In Angular applications with Server-Side Rendering, this vulnerability can be exploited to cause a JavaScript heap out-of-memory crash, making the application unavailable to users. In Client-Side Rendering, it can freeze the browser tab, causing it to become unresponsive.
Users can update to Angular versions 22.0.1, 21.2.17, or 20.3.25 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| angular angular | <= 19.2.25 >= 20.0.0, < 20.3.25 >= 21.0.0, < 21.2.17 >= 22.0.0, < 22.0.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Reanalysis | [email protected] |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |