The @angular/common package in Angular versions up to 19.2.25 contains a Denial of Service vulnerability (CVE-2026-54268) in the formatDate function. This function, also used by DatePipe, does not properly limit or validate the length of the format parameter. When processing a maliciously crafted, excessively long date format string, the internal parser enters a resource-intensive loop, causing high CPU usage and excessive memory allocation. This leads to a DoS by crashing server-side rendering applications with JavaScript heap out of memory errors or freezing client-side browser tabs. Exploitation requires attacker control over the date format string passed to these utilities. Patched versions are 20.3.25, 21.2.17, and 22.0.1.

Exploitation of this vulnerability results in Denial of Service by exhausting CPU and memory resources. On server-side rendered Angular applications, this can cause the server process to crash with out-of-memory errors, making the application unavailable to all users. On client-side rendered applications, it causes the browser tab to freeze and become unresponsive. The impact is high as it affects availability and can be triggered remotely if the date format string is attacker-controlled.

A fix is available in Angular versions 20.3.25, 21.2.17, and 22.0.1. Users should upgrade to one of these patched versions to remediate the vulnerability. Additionally, applications should ensure that the date format string passed to formatDate or DatePipe is not attacker-controlled or is properly validated to limit length and complexity. If the format string is hardcoded or validated, the application is not vulnerable.