Denial of Service Vulnerability in Angular Development Platform
CVE-2026-50171

8.2HIGH

Key Information:

Vendor

Angular

Status
Angular
Vendor
CVE Published:
22 June 2026

What is CVE-2026-50171?

A Denial of Service vulnerability exists in the @angular/common package of Angular that allows an attacker to exploit the formatNumber function and associated pipes like DecimalPipe, PercentPipe, and CurrencyPipe. The issue arises from improper validation of the digitsInfo parameter, particularly the upper bounds for fraction digits. When an attacker passes a crafted digitsInfo string with excessively large values, the internal roundNumber function enters an unbounded loop, leading to potential service disruption. This vulnerability was addressed in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Affected Version(s)

angular >= 22.0.0-next.0, < 22.0.0-rc.2 < 22.0.0-next.0, 22.0.0-rc.2

angular >= 21.0.0-next.0, < 21.2.15 < 21.0.0-next.0, 21.2.15

angular >= 20.0.0-next.0, < 20.3.22 < 20.0.0-next.0, 20.3.22

References

https://github.com/angular/angular/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.