CVE-2026-50171

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23

Description A Denial of Service (DoS) issue exists in the @angular/common package. The formatNumber() function, also used by DecimalPipe, PercentPipe, and CurrencyPipe, fails to validate the upper bounds of the digitsInfo parameter. When a maliciously crafted digitsInfo string containing excessively large fraction digit values is processed, the internal roundNumber() function attempts to pad the digits array to match the requested size, causing an unbounded loop. This leads to resource exhaustion: in Server-Side Rendering (SSR) environments, it can crash the Node.js server process due to a JavaScript heap out of memory error; in Client-Side Rendering (CSR), it blocks the main thread and freezes the browser tab. Exploitation requires the application to use these formatting utilities with a digitsInfo parameter controlled by untrusted user input.

Recommendations Update to version 22.0.0-rc.2. Update to version 21.2.15. Update to version 20.3.22. Update to version 19.2.23. As a temporary workaround, avoid passing untrusted user input directly into the digitsInfo parameter of the formatNumber() function or the affected pipes.