Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-26116 EUVD-2023-0833GHSA-2vrf-hf26-jrp5

angular vulnerable to regular expression denial of service via the angular.copy() utility

Published Mar 30, 2023 · Updated Nov 3, 2025 · Assigned by snyk

Package: angular Package: angular.js Package: angular.js Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Affected products

VendorProductAffectedFixed
— angular 1.2.21 —
— org.webjars.bower:angular 1.2.21 —
— org.webjars.npm:angular 1.2.23 —
— org.webjars.bowergithub.angular:angular — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 angular.js 1.8.3-2 —
Debian 12 angular.js 1.8.3-1+deb12u1 —
Debian 11 angular.js 1.8.3-1+deb12u1~deb11u1 DLA-4242-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS angular.js 1.8.3-1ubuntu0.24.04.1 —
Ubuntu 22.04 LTS angular.js 1.8.2-2ubuntu0.1 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS angular.js 1.7.9-1ubuntu0.1~esm1 —
Ubuntu Pro 18.04 LTS angular.js 1.5.10-1ubuntu0.1~esm1 —
Ubuntu Pro 16.04 LTS angular.js 1.2.28-1ubuntu2+esm1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm angular <= 1.8.3 — GHSA-2vrf-hf26-jrp5

Advisories 3

References