Is CVE-2023-26116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-26116 being exploited in the wild.

How severe is CVE-2023-26116?

Low severity, with a CVSS score of 3.1, published 30 March 2023.

Which products and versions are affected?

angular (npm) SEMVER:introduced=0,last_affected=1.8.3.

Is there a fix for CVE-2023-26116?

A patch was published on 2025-07-20: Debian LTS released a security update for angular.js. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-26116 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-26116?

Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-26116: Google AngularJS ReDoS in angular.copy utility

CVE-2023-26116 · Severity: low · CVSS 3.1 · Published 2023-03-30

AngularJS, a popular framework for building web applications, is vulnerable to a denial-of-service attack. By providing specially crafted, large inputs to certain data-copying functions, an attacker can cause the application to become unresponsive. This can lead to service outages or a degraded experience for legitimate users.

Technologies: angular (npm). Vendors: npm.

Quick answers

Is CVE-2023-26116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-26116 being exploited in the wild.
How severe is CVE-2023-26116?: Low severity, with a CVSS score of 3.1, published 30 March 2023.
Which products and versions are affected?: angular (npm) SEMVER:introduced=0,last_affected=1.8.3.
Is there a fix for CVE-2023-26116?: A patch was published on 2025-07-20: Debian LTS released a security update for angular.js. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26116 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-26116?: Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in AngularJS versions 1.2.21 through 1.8.3. The flaw is located within the angular.copy() utility function, which utilizes an insecure regular expression. An attacker can exploit this by providing a large, carefully-crafted input string that triggers catastrophic backtracking during regex evaluation. This results in excessive CPU consumption, leading to a denial-of-service condition. The vulnerability is reachable over the network without authentication, provided the application passes user-controlled input to the affected utility. Fixes are available in updated package versions provided by downstream maintainers like Debian and Fedora.

Affected products

Google angular >= 1.2.21, <= 1.8.3

Identifiers

CVE-2023-26116
GHSA-2vrf-hf26-jrp5

Timeline

2023-03-30: advisory: Initial publication of the GHSA advisory.
2023-03-30: disclosed: NVD publication date.
2025-07-20: patched: Debian LTS released a security update for angular.js.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.