CVE-2022-25844: angular vulnerable to regular expression denial of service (ReDoS)
(updated )
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ’ ‘.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
Note:
- This package has been deprecated and is no longer maintained.
- The vulnerable versions are 1.7.0 and higher.
References
- github.com/advisories/GHSA-m2h2-264f-f486
- github.com/angular/angular.js
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO
- nvd.nist.gov/vuln/detail/CVE-2022-25844
- security.netapp.com/advisory/ntap-20220629-0009
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737
- snyk.io/vuln/SNYK-JS-ANGULAR-2772735
- stackblitz.com/edit/angularjs-material-blank-zvtdvb
Code Behaviors & Features
Detect and mitigate CVE-2022-25844 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →