CVE-2026-50171: Google Angular Denial of Service in @angular/common number formatting

CVE-2026-50171 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular is a popular development framework used to build web and mobile applications. A flaw in how it handles number formatting allows an attacker to crash a web server or freeze a user's browser by providing specially crafted, excessively large formatting instructions. This can lead to a total service outage for applications using server-side rendering or a broken user experience for individual visitors.

Technologies: @angular/common (npm). Vendors: npm.

Quick answers

Is CVE-2026-50171 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50171 being exploited in the wild.
How severe is CVE-2026-50171?
High severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?
@angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-rc.2.
Is there a fix for CVE-2026-50171?
Yes. @angular/common (npm): upgrade to 22.0.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50171 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50171?
Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/common (npm): upgrade to 22.0.0-rc.2 or later
    npm install @angular/common@22.0.0-rc.2

Technical details

A Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular within the formatNumber function and associated pipes (DecimalPipe, PercentPipe, CurrencyPipe). The root cause is a failure to validate the upper bounds of the digitsInfo parameter; when excessively large fraction digit values are provided, the internal roundNumber function enters an unbounded loop while attempting to pad a digits array. In Server-Side Rendering (SSR) environments, this leads to a Node.js heap out-of-memory (OOM) crash. In Client-Side Rendering (CSR) environments, it blocks the main thread, causing the browser tab to become unresponsive. Exploitation requires that the digitsInfo parameter be controllable by untrusted user input.

Affected products

  • Google Angular < 19.2.23, >= 20.0.0-next.0 < 20.3.22, >= 21.0.0-next.0 < 21.2.15, >= 22.0.0-next.0 < 22.0.0-rc.2

Identifiers

  • CVE-2026-50171
  • GHSA-p3vc-36g9-x9gr

Timeline

  • 2026-05-28: advisory: GitHub advisory published by Angular maintainers
  • 2026-06-22: disclosed: NVD publication date
  • 2026-06-22: patched: Fixes released in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.