GHSA-2qqx-w9hr-q5gx CVE-2023-26117
angular vulnerable to regular expression denial of service via the $resource service
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.70%
- Chance of exploitation in the next 30 days. Higher than 77.14% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
- None yet
- No fixed version published
Description
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| angular | <= 1.8.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJL…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFL…
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324
- security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045
- stackblitz.com/edit/angularjs-vulnerability-resource-trailing-slashes-redos
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFL…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7x27-g8rg-x87w Angular's deprecated package has a Cross-Site Scripting issue | High | Also affects angular |
| GHSA-j58c-ww9w-pwp5 AngularJS improperly sanitizes SVG elements | Medium | Also affects angular |
| GHSA-mqm9-c95h-x2p6 AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-m9gf-397r-hwpg AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-4w4v-5hc9-xrr2 angular vulnerable to super-linear runtime due to backtracking | High | Also affects angular |
| GHSA-qwqh-hm9m-p5hr angular vulnerable to regular expression denial of service via the <input type="url"> element | Medium | Also affects angular |
| GHSA-2vrf-hf26-jrp5 angular vulnerable to regular expression denial of service via the angular.copy() utility | Medium | Also affects angular |
| GHSA-prc3-vjfx-vhm9 Angular (deprecated package) Cross-site Scripting | Medium | Also affects angular |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor