CVE-2026-54268: Angular DatePipe Denial of Service – High CVSS 7.5

Technical summary

The @angular/common package's formatDate function lacks input validation on the format parameter's length. The internal parser uses regex-based string splitting in an iterative loop to process the format string. When an attacker supplies an excessively long or pathologically repetitive format string, the regex matching and string splitting operations consume resources in an uncontrolled manner, causing high CPU utilization and unbounded memory allocation. This is classified as CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption), both of which describe scenarios where algorithmic complexity or missing bounds checks allow denial of service.

Business impact

Applications built with Angular that expose date formatting capabilities—either through user-supplied format strings or by incorporating untrusted data into DatePipe calls—face service disruption risk. This includes web dashboards, reporting tools, and any interface where date presentation is customizable. A single malicious request can degrade performance for all concurrent users on the same instance or container, potentially triggering cascading failures in microservice architectures. The attack requires no special privileges, making it a low-barrier-to-entry denial-of-service vector that could be weaponized by external threat actors or malicious internal users.

Affected systems

Angular framework versions prior to 22.0.1, 21.2.17, and 20.3.25 are vulnerable. This includes the Long-Term Support (LTS) branch (v20) and the current-generation branch (v21/v22). Organizations running Angular applications across any of these versions should prioritize assessment. The @angular/common package is a core dependency in virtually all Angular projects, meaning the vulnerability's blast radius is broad. Custom applications and third-party libraries that wrap or directly call formatDate are also at risk.

Exploitability

Exploitation is straightforward and requires no authentication or user interaction. An attacker simply constructs a malicious date format string—examples include long repetitive patterns like 'yyyy-MM-dd' repeated hundreds of times, or a single extremely long character sequence—and passes it to the vulnerable function. If the application accepts format parameters from external sources (query parameters, API payloads, form inputs), the attack is trivial to deliver at scale. The network-accessible, low-complexity nature of this vulnerability (CVSS vector AV:N/AC:L/PR:N/UI:N) means it can be exploited by anyone with network access to the application.

Remediation

Upgrade to Angular 22.0.1, 21.2.17, or 20.3.25 or later. These releases include input validation and optimization of the formatDate parser to prevent excessive resource consumption. Organizations on v20 should target 20.3.25+, those on v21 should target 21.2.17+, and those on the latest release should target 22.0.1+. After patching, redeploy applications and verify that date formatting continues to function as expected in production environments.

Patch guidance

1. Review your package.json or lock files to identify current Angular versions across all projects and environments. 2. Plan an upgrade path: prioritize applications that accept user-supplied date format strings or expose DatePipe with external data. 3. For v20, update to 20.3.25 or later; for v21, update to 21.2.17 or later; for v22, update to 22.0.1 or later. 4. Run full regression tests on date-related functionality, including edge cases with unusual or very long format strings. 5. Validate that no custom date formatting logic relies on the previous parser behavior. 6. Roll out in a staged manner (dev → staging → production) to catch any compatibility issues early.

Detection guidance

Monitor application logs and metrics for sudden spikes in CPU utilization or memory consumption following HTTP requests, especially those containing long or unusual date format parameters in query strings, headers, or POST bodies. Web application firewalls (WAF) can be configured to block requests containing suspiciously long format parameters (e.g., strings exceeding 100 characters when passed to known date endpoints). Runtime monitoring tools can detect regex backtracking or excessive string operations in the @angular/common module. Additionally, review application code to identify all places where user input flows into formatDate or DatePipe, and add input length and character validation at the application layer as a defense-in-depth measure.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), trivial exploitability, and broad attack surface. Any Angular application accepting external date format parameters is at risk. Unlike many vulnerabilities that require specific conditions or user privileges, this can be exploited by an unauthenticated remote attacker with a single HTTP request. The denial-of-service impact can degrade service availability for all users on an instance, and the fix is straightforward—a routine dependency upgrade. Organizations should prioritize patching as part of an emergency maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no privileges required, and no user interaction needed, resulting in high impact to availability. The score does not account for confidentiality or integrity, as this is a pure denial-of-service vector. Given Angular's ubiquity in modern web development and the likelihood that many applications receive untrusted input, the real-world risk may be higher; this score should be considered a minimum baseline.

Frequently asked questions