Jean Meche

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 **Description** A Denial of Service (DoS) issue exists in the `@angular/common` package. The `formatDate()` function, also used by the standard `DatePipe`, fails to properly limit or validate the length of the `format` parameter. When an excessively long or maliciously crafted date format string is parsed, the internal parser uses a regular expression loop that causes uncontrolled resource consumption, specifically high CPU utilization and excessive memory allocations. In Server-Side Rendering (SSR) environments, this can lead to a JavaScript heap out of memory crash, making the application unavailable. In Client-Side Rendering (CSR) environments, it blocks the browser's main thread, causing the tab to freeze. Exploitation requires the application to use the `formatDate()` utility or `DatePipe` with a `format` parameter that is controlled by untrusted user input. **Recommendations** Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. As a temporary workaround, restrict the `format` parameter to a reasonable length limit or use hardcoded static strings to prevent untrusted input from reaching the `formatDate()` function or `DatePipe`.