p PatchFirst

CVE-2026-54268

CVE-2026-54268 · Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

CVSS 8.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • angular

    Versions
    • >= 22.0.0-next.0 < 22.0.1: Affected
    • >= 21.0.0-next.0 < 21.2.17: Affected
    • >= 20.0.0-next.0 < 20.3.25: Affected
    • <= 19.2.25: Affected

    No fix published

  • angular.js Debian:12

    Versions
    • 1.8.3-1
    • 1.8.3-1+deb12u1
    • 1.8.3-1+deb12u1~deb11u1
    • 1.8.3-2
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Debian:13

    Versions
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • @angular/common npm

    Affected ranges
    • SEMVER: ≥ 22.0.0-next.0, < 22.0.1

    Update to 22.0.1

  • @angular/common npm

    Affected ranges
    • SEMVER: ≥ 21.0.0-next.0, < 21.2.17

    Update to 21.2.17

  • @angular/common npm

    Affected ranges
    • SEMVER: ≥ 20.0.0-next.0, < 20.3.25

    Update to 20.3.25

  • @angular/common npm

    Affected ranges
    • SEMVER: ≤ 19.2.25

    No fix published

  • angular.js Ubuntu:Pro:16.04:LTS

    Versions
    • 1.2.28-1ubuntu2
    • 1.2.28-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:Pro:18.04:LTS

    Versions
    • 1.5.10-1
    • 1.5.10-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:Pro:20.04:LTS

    Versions
    • 1.5.10-1
    • 1.7.9-1
    • 1.7.9-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:22.04:LTS

    Versions
    • 1.8.2-2
    • 1.8.2-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:24.04:LTS

    Versions
    • 1.8.3-1
    • 1.8.3-1ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:25.10

    Versions
    • 1.8.3-1
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:26.10

    Versions
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:26.04:LTS

    Versions
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →