GHSA-2vrf-hf26-jrp5
angular vulnerable to regular expression denial of service via the angular.copy() utility
At a glance
- Published
- Updated
- CVE
- CVE-2023-26116
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Affected packages
| Package | Versions |
|---|---|
| npm · angular | introduced 0, last affected 1.8.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-26116 ADVISORY
- https://github.com/angular/angular.js PACKAGE
- https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320 WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322 WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321 WEB
- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044 WEB
- https://stackblitz.com/edit/angularjs-vulnerability-angular-copy-redos WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |