# CVE-2026-50171: Google Angular Denial of Service in @angular/common number formatting

Source: https://junglewise.ai/threats/cve-2026-50171-google-angular-denial-of-service-in-angular-common-number  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-50171 · Severity: high · CVSS 3.1 · Published 2026-06-22

Angular is a popular development framework used to build web and mobile applications. A flaw in how it handles number formatting allows an attacker to crash a web server or freeze a user's browser by providing specially crafted, excessively large formatting instructions. This can lead to a total service outage for applications using server-side rendering or a broken user experience for individual visitors.

Technologies: [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-50171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50171 being exploited in the wild.

**How severe is CVE-2026-50171?** High severity, with a CVSS score of 3.1, published 22 June 2026.

**Which products and versions are affected?** @angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-rc.2.

**Is there a fix for CVE-2026-50171?** Yes. @angular/common (npm): upgrade to 22.0.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50171 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50171?** Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/common (npm): upgrade to 22.0.0-rc.2 or later

  ```sh
  npm install @angular/common@22.0.0-rc.2
  ```


## Technical details

A Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular within the formatNumber function and associated pipes (DecimalPipe, PercentPipe, CurrencyPipe). The root cause is a failure to validate the upper bounds of the digitsInfo parameter; when excessively large fraction digit values are provided, the internal roundNumber function enters an unbounded loop while attempting to pad a digits array. In Server-Side Rendering (SSR) environments, this leads to a Node.js heap out-of-memory (OOM) crash. In Client-Side Rendering (CSR) environments, it blocks the main thread, causing the browser tab to become unresponsive. Exploitation requires that the digitsInfo parameter be controllable by untrusted user input.

## Affected products

- Google Angular < 19.2.23, >= 20.0.0-next.0 < 20.3.22, >= 21.0.0-next.0 < 21.2.15, >= 22.0.0-next.0 < 22.0.0-rc.2

## Identifiers

- CVE-2026-50171
- GHSA-p3vc-36g9-x9gr

## Timeline

- 2026-05-28: advisory: GitHub advisory published by Angular maintainers
- 2026-06-22: disclosed: NVD publication date
- 2026-06-22: patched: Fixes released in versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23

## References

- [https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr](https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr)

## Related threats

- [Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in)
- [Angular information leak in HttpTransferCache with hierarchical HttpClient](https://junglewise.ai/threats/cve-2026-88059-angular-information-leak-in-httptransfercache-with-hierarchical)
- [Angular HttpTransferCache cache-key ambiguity in SSR](https://junglewise.ai/threats/cve-2026-68945-angular-httptransfercache-cache-key-ambiguity-in-ssr)
- [Google Angular information disclosure in @angular/common HttpTransferCache](https://junglewise.ai/threats/cve-2026-50170-google-angular-information-disclosure-in-angular-common)
- [Google Angular weak hashing in HttpTransferCache cache keys](https://junglewise.ai/threats/cve-2026-54266-google-angular-weak-hashing-in-httptransfercache-cache-keys)