CVE-2026-54268

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25

Description A Denial of Service (DoS) issue exists in the @angular/common package. The formatDate() function, also used by the standard DatePipe, fails to properly limit or validate the length of the format parameter. When an excessively long or maliciously crafted date format string is parsed, the internal parser uses a regular expression loop that causes uncontrolled resource consumption, specifically high CPU utilization and excessive memory allocations. In Server-Side Rendering (SSR) environments, this can lead to a JavaScript heap out of memory crash, making the application unavailable. In Client-Side Rendering (CSR) environments, it blocks the browser's main thread, causing the tab to freeze. Exploitation requires the application to use the formatDate() utility or DatePipe with a format parameter that is controlled by untrusted user input.

Recommendations Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. As a temporary workaround, restrict the format parameter to a reasonable length limit or use hardcoded static strings to prevent untrusted input from reaching the formatDate() function or DatePipe.