Executive Summary

This vulnerability is a Denial of Service (DoS) issue in the Angular framework's @angular/common package, specifically in the formatDate function and the DatePipe utility.

The problem occurs when a maliciously crafted, excessively long date format string is parsed. The internal parser uses a regular expression loop that iteratively splits the string, which leads to uncontrolled resource consumption such as high CPU usage and excessive memory allocation.

As a result, this can cause the server to crash in Server-Side Rendering (SSR) scenarios or freeze the browser tab in Client-Side Rendering (CSR) applications.

The vulnerability affects Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 and is fixed by limiting the maximum length of the date format string to 256 characters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing Denial of Service (DoS) conditions in your Angular applications.

If an attacker can supply or control the date format string (for example, through user input or API responses), they can craft an excessively long format string that triggers high CPU usage and memory consumption.

This can lead to your server crashing in SSR environments or freezing the browser tab in CSR environments, resulting in service unavailability or degraded user experience.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your Angular application uses vulnerable versions of the @angular/common package, specifically versions prior to 22.0.1, 21.2.17, and 20.3.25.

Detection involves checking the Angular package version in your project dependencies and monitoring for unusually high CPU or memory usage when processing date format strings.

You can run commands to check the installed Angular version, for example:

• npm list @angular/common
• cat package.json | grep @angular/common

Additionally, monitoring system resource usage during application runtime can help detect exploitation attempts, such as using tools like top, htop, or Windows Task Manager to observe CPU and memory spikes.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the @angular/common package to a patched version where the vulnerability is fixed.

• Upgrade to Angular versions 22.0.1, 21.2.17, or 20.3.25 or later.

These versions include a validation that limits the length of date format strings to a maximum of 256 characters, throwing an error if exceeded, thus preventing the Denial of Service attack.

If immediate upgrade is not possible, consider implementing input validation to restrict the length of date format strings passed to the formatDate function or DatePipe.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this Denial of Service (DoS) vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0