CVE-2026-54268 (High) detected in common-12.2.5.tgz

[mend-for-github-com]

CVE-2026-54268 - High Severity Vulnerability

Vulnerable Library - common-12.2.5.tgz

Angular - commonly needed directives and services

Library home page: https://registry.npmjs.org/@⁠angular/common/-/common-12.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ common-12.2.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @⁠angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Publish Date: 2026-06-22

URL: CVE-2026-54268

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-48r7-hpm6-gfxm

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v21.2.17,https://github.com/angular/angular.git - v20.3.25

---

• Check this box to open an automated fix PR