CVE-2026-50171: Angular formatNumber DoS Vulnerability – CVSS 6.1 Medium

Technical summary

The vulnerability resides in Angular's @angular/common package, specifically in the formatNumber function and its downstream consumers (DecimalPipe, PercentPipe, CurrencyPipe). The digitsInfo parameter (e.g., '1.2-4' meaning 1 integer digit and 2–4 fraction digits) lacks upper-bound validation. When a malicious digitsInfo string specifies extremely large maximum fraction values (e.g., '1.200000000-200000000'), the internal roundNumber function attempts to pad a digits array to accommodate all requested fractional positions. This triggers an unbounded loop that repeatedly appends elements to the array, causing resource exhaustion. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-834 (Excessive Iteration).

Business impact

Applications relying on Angular's formatting pipes to display numeric content (pricing, analytics dashboards, financial portals, reporting systems) can be remotely crashed by attackers who control input data or template expressions. The attack requires user interaction (clicking a link, viewing a crafted page) but does not require authentication. Availability impact ranges from temporary unresponsiveness to complete application failure, disrupting user productivity and potentially affecting downstream services that depend on the affected application.

Affected systems

Angular applications running versions prior to 22.0.0-rc.2 (v22 branch), 21.2.15 (v21 branch), 20.3.22 (v20 branch), and 19.2.23 (v19 branch) are affected. Any application using @angular/common's formatNumber function, DecimalPipe, PercentPipe, or CurrencyPipe in templates or component code is in scope if user-controlled or untrusted data flows into the digitsInfo parameter.

Exploitability

Exploitability is straightforward if an attacker can influence the digitsInfo format string. Attack vectors include: (1) crafted query parameters or URL fragments binding to template pipes, (2) untrusted data from APIs or external sources displayed via pipes, (3) social engineering to visit a malicious page hosting an Angular application with injected formatting directives. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects network accessibility, low complexity, no privileges required, but requires user interaction. This is not an exploitation that occurs silently in the background.

Remediation

Update Angular to version 22.0.0-rc.2 or later (v22 stable when released), 21.2.15, 20.3.22, or 19.2.23. These versions include validation to enforce reasonable upper bounds on digitsInfo parameters, preventing unbounded array padding. Applications should also audit template expressions and component code to avoid binding user input directly to the digitsInfo parameter of number pipes; apply input sanitization and schema validation where appropriate.

Patch guidance

Upgrade @angular/common via npm: 'npm install @angular/<package>@latest' or specify the patched version directly (e.g., '@angular/[email protected]'). Verify your package.json and package-lock.json reflect the new version. If you are on v19, v20, or v21, select the appropriate patch release. Test formatting pipes with your existing numeric data to ensure no regressions in decimal or currency display. For monorepo setups, ensure all Angular packages are updated together to maintain compatibility.

Detection guidance

Monitor application logs for excessive memory growth or CPU spikes correlating with number formatting operations. In development, add logging to digitsInfo inputs before they reach pipes to identify unusually large digit specifications. Use Angular's built-in change detection profiling to detect unexplained reflows or loops. Network-level detection is limited; focus on application-level alerts for slow response times or crashes following requests with unusual formatting parameters. Consider implementing Content Security Policy (CSP) to restrict script execution and reduce the attack surface if third-party content is rendered.

Why prioritize this

Although the CVSS score of 6.1 (MEDIUM) reflects the need for user interaction, the ease of exploitation and potential for widespread denial of service in customer-facing applications warrants rapid patching. Angular is widely used in enterprise and SaaS environments. The fix is available and straightforward to deploy. Organizations should prioritize this update within a normal patch cycle, especially if applications expose number formatting to untrusted input.

Risk score, explained

CVSS 6.1 (MEDIUM) combines moderate severity (availability impact, some confidentiality/integrity side-effects per the vector) with low attack complexity and no privilege requirements. The user interaction requirement (clicking a link, loading a page) prevents a higher score, but the network-accessible nature and ease of triggering the flaw via simple parameter manipulation keep it above LOW. In environments where Angular apps are internet-facing or serve untrusted users, practical risk is elevated.

Frequently asked questions