# CVE-2022-25844: Angular regular expression denial of service in locale formatting

Source: https://junglewise.ai/threats/cve-2022-25844-angular-regular-expression-denial-of-service-in-locale-formatting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25844 · Severity: low · CVSS 3.1 · Published 2022-05-03

AngularJS is a JavaScript framework for building client-side web applications. A vulnerability in the locale formatting feature allows attackers to trigger a regular expression denial of service (ReDoS) by providing a specially crafted locale configuration, potentially causing the application to become unresponsive or crash. This affects applications using AngularJS version 1.7.0 and later.

Technologies: [AngularJS](https://junglewise.ai/threats/technologies/angularjs), [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [Angular](https://junglewise.ai/threats/vendors/angular), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25844 being exploited in the wild.

**How severe is CVE-2022-25844?** Low severity, with a CVSS score of 3.1, published 3 May 2022.

**Which products and versions are affected?** AngularJS 1.7.0 and later; angular (npm) SEMVER:introduced=1.7.0.

**Is there a fix for CVE-2022-25844?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-25844 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-25844?** Check whether you run AngularJS or angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in AngularJS's locale formatting logic, specifically in the NUMBER_FORMATS.PATTERNS[1].posPre parameter handling. An attacker can provide a custom locale rule with an extremely high repetition count in the posPre field (via String.repeat()), which triggers catastrophic backtracking in the underlying regular expression engine, consuming excessive CPU resources. The attack vector is network-based and requires no authentication or user interaction; the malicious payload is supplied via locale configuration. This is a ReDoS (CWE-1333) vulnerability, causing denial of service without data compromise. AngularJS has been deprecated and no longer maintained, making patching unlikely.

## Affected products

- Angular AngularJS 1.7.0 and later

## Identifiers

- CVE-2022-25844
- GHSA-m2h2-264f-f486

## Timeline

- 2022-05-01: disclosed
- 2022-05-03: advisory: GHSA-m2h2-264f-f486 published

## References

- [https://github.com/angular/angular.js](https://github.com/angular/angular.js)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)