GHSA-p3vc-36g9-x9gr is a medium-severity (CVSS 6.1) Uncontrolled Resource Consumption vulnerability in @angular/common. A fix is available for @angular/common — see the affected versions and patch details below.
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-p3vc-36g9-x9gr.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-p3vc-36g9-x9gr by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@angular/commonnpmDescription
A Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits.
When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array.
Impact
Successful exploitation of this vulnerability allows an attacker to trigger resource exhaustion, leading to a Denial of Service (DoS):
- Server-Side Rendering (SSR): In applications using SSR (e.g.,
@angular/ssr), an attacker can crash the Node.js server process due to aJavaScript heap out of memoryerror. This affects the availability of the application for all users. - Client-Side Rendering (CSR): In standard client-side applications, the unbounded loop will block the main thread, freezing the user's browser tab and making it unresponsive.
Attack Preconditions
For this vulnerability to be exploitable, the following conditions must be met:
- Vulnerable Component Usage: The application must use Angular's number formatting utilities, such as the
formatNumberfunction directly, or via template pipes (DecimalPipe,PercentPipe,CurrencyPipe). - Attacker-Controlled Parameter: The
digitsInfoparameter passed to these utilities must be customizable or directly controlled by untrusted user input (e.g., parsed from query parameters, user preference settings, or API responses that accept user-defined formatting options). IfdigitsInfois trusted or limited to a known, defined range for its value, the vulnerability is not exploitable by external attackers.
Patches
- 22.0.0-rc.2
- 21.2.15
- 20.3.22
- 19.2.23
Credits
This vulnerability was discovered and reported by CodeMender from Google DeepMind.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @angular/common | ≥ 22.0.0-next.0&&< 22.0.0-rc.2 | 22.0.0-rc.2npm install @angular/common@22.0.0-rc.2 |
| 📦npm | @angular/common | ≥ 20.0.0-next.0&&< 20.3.22 | 20.3.22npm install @angular/common@20.3.22 |
| 📦npm | @angular/common | ≥ 19.0.0-next.0&&< 19.2.23 | 19.2.23npm install @angular/common@19.2.23 |
| 📦npm | @angular/common | all versions | No fix |
| 📦npm | @angular/common | ≥ 21.0.0-next.0&&< 21.2.15 | 21.2.15npm install @angular/common@21.2.15 |
Affected Products
angularangularDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @angular/common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @angular/common to 22.0.0-rc.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p3vc-36g9-x9gr is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A flaw was found in the @angular/common package. The formatNumber function, also used by DecimalPipe, PercentPipe, and CurrencyPipe, does not validate the upper bounds of the digitsInfo parameter. When a maliciously crafted digitsInfo string with excessively large fraction digit values is provided, the internal…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Upgrade to fixed versions or apply patches (ref: https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr)Source: Red Hat security advisory for GHSA-p3vc-36g9-x9gr (CC BY 4.0)
Frequently Asked Questions
Is GHSA-p3vc-36g9-x9gr in your dependencies?
Find it across npm, including transitive dependencies.