GHSA-p3vc-36g9-x9gr: @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Summary
Angular's `formatNumber` function (used by DecimalPipe, PercentPipe, and CurrencyPipe for formatting numbers in templates) has a vulnerability where it doesn't limit how large the `digitsInfo` parameter (which specifies decimal places, like '1.2-4') can be. An attacker who can control this parameter can force the function into an unbounded loop that crashes the server with an out-of-memory error in server-side applications, or freezes the user's browser in client-side applications.
Solution / Mitigation
Update to one of these patched versions: Angular 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23.
Vulnerability Details
EPSS: 0.0%
Yes
June 15, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-p3vc-36g9-x9gr
First tracked: June 15, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%