Security Alert – CVE-2026-54268

[github-actions]

General Information

• Title: @angular/common: Angular @angular/common: Denial of Service via crafted date format string
• Category: vulnerabilities
• Severity: high
• Published date: 2026-06-22
• Short Description: @angular/common: Angular @angular/common: Denial of Service via crafted date format string

Affected Package

• Package name: @angular/common
• Fixed version: 22.0.1, 21.2.17, 20.3.25

Classification

• Rule: CVE-2026-54268
• Category: vulnerabilities
• Advisory URL: https://access.redhat.com/security/cve/CVE-2026-54268

References

• https://access.redhat.com/security/cve/CVE-2026-54268
• https://github.com/angular/angular
• angular/angular@eeb03f4
• [Backport 20.3.x] fix(common): Limits date format string length angular/angular#69197
• GHSA-48r7-hpm6-gfxm
• https://nvd.nist.gov/vuln/detail/CVE-2026-54268
• https://www.cve.org/CVERecord?id=CVE-2026-54268