@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

🗓️ 15 Jun 2026 16:52:30Reported by GitHub Advisory DatabaseType

Denial of Service in Angular common formatNumber due to unvalidated digitsInfo causing exhaustion.

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]	22 Jul 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	24 Jul 202606:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Angular,Netty,snakeYAML,Next.js might affect IBM Storage Defender Copy Data Management	30 Sep 202617:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certifcate Manager	29 Jun 202614:12	–	ibm
attackerkb	CVE-2026-50171	22 Jun 202615:49	–	attackerkb
Chainguard	CVE-2026-50171 vulnerabilities	15 Jul 202614:17	–	cgr
Circl	CVE-2026-50171	22 Jun 202623:14	–	circl
CVE	CVE-2026-50171	22 Jun 202615:49	–	cve
Cvelist	CVE-2026-50171 Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)	22 Jun 202615:49	–	cvelist
Debian CVE	CVE-2026-50171	22 Jun 202615:49	–	debiancve

Vulners

Node

angular commonRange21.0.0-next.0–21.2.15npm

angular commonRange≤18.2.14npm

angular commonRange19.0.0-next.0–19.2.23npm

angular commonRange20.0.0-next.0–20.3.22npm

angular commonRange22.0.0-next.0–22.0.0-rc.2npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr
github	www.github.com/angular/angular/pull/68840
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-50171
github	www.github.com/advisories/GHSA-p3vc-36g9-x9gr

15 Jul 2026 22:05Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

CVSS 48.2

EPSS0.00256

SSVC