Executive Summary

This vulnerability is a Denial of Service (DoS) issue in the @angular/common package of Angular, specifically in the formatNumber function and related pipes like DecimalPipe, PercentPipe, and CurrencyPipe.

The problem occurs because the digitsInfo parameter, which controls number formatting, does not properly validate the upper bounds of the minimum and maximum fraction digits. When a maliciously crafted digitsInfo string with excessively large fraction digit values is used, the internal roundNumber function enters an unbounded loop that repeatedly pushes elements into an array.

This unbounded loop leads to uncontrolled resource consumption, potentially crashing Node.js servers in Server-Side Rendering (SSR) environments or freezing browser tabs in Client-Side Rendering (CSR) scenarios.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can cause Denial of Service by exhausting system resources.

• In Server-Side Rendering (SSR) environments, it can crash Node.js servers due to JavaScript heap out-of-memory errors.
• In Client-Side Rendering (CSR) scenarios, it can freeze browser tabs by blocking the main thread.

The vulnerability requires that the application uses Angular's number formatting utilities with attacker-controlled or customizable digitsInfo parameters.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when the Angular @angular/common package's formatNumber function or related pipes (DecimalPipe, PercentPipe, CurrencyPipe) process a digitsInfo parameter with excessively large fraction digit values, leading to unbounded loops and resource exhaustion.

To detect this vulnerability on your system, you should first identify if your application uses vulnerable versions of Angular prior to 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23.

You can check the Angular version used in your project by running the following command in your project directory:

• npm list @angular/common

To detect if the vulnerable function is being exploited or triggered, monitor your application logs and system resource usage for symptoms such as Node.js server crashes due to heap out-of-memory errors or browser freezes.

There are no specific commands provided to detect malicious digitsInfo parameter usage directly, but you can audit your codebase for usage of formatNumber or the related pipes with user-controllable digitsInfo inputs.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the @angular/common package to a fixed version where this vulnerability is resolved.

• Upgrade to Angular versions 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23 or later.

If immediate upgrade is not possible, ensure that the digitsInfo parameter used in formatNumber and related pipes is not controllable by untrusted users or inputs.

Additionally, monitor your application for unusual resource consumption or crashes that may indicate exploitation attempts.

Useful 0 Not Useful 0