angular/angular.js · Security
angular vulnerable to regular expression denial of service (ReDoS)
- GHSA ID
- GHSA-m2h2-264f-f486
- CVE ID
- CVE-2022-25844
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
Note:
- This package has been deprecated and is no longer maintained.
- The vulnerable versions are 1.7.0 and higher.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
- CWE-1333 · Inefficient Regular Expression Complexity
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25844 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737 ↗
- https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735 ↗
- https://stackblitz.com/edit/angularjs-material-blank-zvtdvb ↗
- https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO ↗
- https://security.netapp.com/advisory/ntap-20220629-0009 ↗
- https://github.com/advisories/GHSA-m2h2-264f-f486 ↗