Regular Expression Denial of Service Vulnerability in AngularJS
Summary
DEBIAN-CVE-2025-4690: A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. Affects angular.js versions 1.8.2-2 – 1.8.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AngularJS is a widely-used open-source web application framework that allows developers to create dynamic single-page applications. It provides features such as two-way data binding, dependency injection, and a modular architecture. However, AngularJS has reached its End-of-Life status, meaning it no longer receives updates or security patches, making it vulnerable to various security issues, including the one described here.
Vulnerability Detail
The vulnerability arises from a regular expression used by AngularJS's linky filter, which is responsible for detecting URLs in input text. This regular expression is susceptible to super-linear runtime due to backtracking, leading to a Regular Expression Denial of Service (ReDoS) attack. An attacker can exploit this vulnerability by crafting a large input that causes the application to hang or crash, severely impacting its availability. This issue affects all versions of AngularJS, and since the project is no longer maintained, no official fix will be provided.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds available for this vulnerability due to the nature of the issue and the lack of updates for AngularJS. However, you can implement input validation and sanitization to mitigate the risk of malicious input being processed by the application.
Conclusion
The Regular Expression Denial of Service vulnerability in AngularJS poses a significant risk to applications still using this framework. With no patches available due to its End-of-Life status, it is crucial for developers to consider migrating to a supported framework to ensure ongoing security and stability.
See every vulnerability recorded for angular.js →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate level of risk.
All versions of AngularJS are affected by this vulnerability.
A ReDoS attack exploits the inefficiencies of regular expressions, causing the application to consume excessive resources and potentially crash.
No, there is no patch available as AngularJS has reached its End-of-Life status and will not receive updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
