Description
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ‘ ‘.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
Note: 1.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 1.7.0
References
Could your website be exposed too?
SmartScanner can check your website for angular vulnerable to regular expression denial of service (ReDoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify - CVE-2021-23346
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
- angular vulnerable to regular expression denial of service via the <input type="url"> element - CVE-2023-26118
- angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117
You might also like:
See something that needs correcting? Let us knowUpdated November 03, 2025