AIKIDO-2026-10987
@angular/common is vulnerable to Denial of Service
82
High Risk
This Affects:
@angular/commonTL;DR
Angular number formatting utilities parse the digitsInfo argument without bounding extremely large fraction digit values. When attacker-controlled formatting options reach formatNumber, DecimalPipe, PercentPipe, or CurrencyPipe, the formatter can repeatedly pad an internal array until the process or browser tab exhausts memory. SSR applications can crash their Node.js render process, while browser-only applications can freeze the active tab. The patch adds upper bounds for parsed digitsInfo values before formatting.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/common is vulnerable to Denial of Service in versions 21.0.0 - 21.2.14, 20.0.0 - 20.3.21 and 19.0.0 - 19.2.22.
How to fix this
Upgrade the @angular/common library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant