Skip to content
OpenAdvisories
Medium · 5.3 CVE-2022-25844 EUVD-2022-4470GHSA-m2h2-264f-f486

Regular Expression Denial of Service (ReDoS)

Published May 1, 2022 · Updated Nov 3, 2025 · Assigned by snyk

Package: angular Package: angular.js Package: angular.js Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Affected products

VendorProductAffectedFixed
— angular next of 1.7.0 – < unspecified unspecified

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 angular.js 1.8.3-2 —
Debian 12 angular.js 1.8.3-1+deb12u1 —
Debian 11 angular.js 1.8.3-1+deb12u1~deb11u1 DLA-4242-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS angular.js 1.8.3-1ubuntu0.24.04.1 —
Ubuntu 22.04 LTS angular.js 1.8.2-2ubuntu0.1 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS angular.js 1.7.9-1ubuntu0.1~esm1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm angular >= 1.7.0 — GHSA-m2h2-264f-f486

Advisories 3

References