Junglewise Threat Intelligence

CVE-2023-26116: Google AngularJS ReDoS in angular.copy utility

CVE-2023-26116 · Severity: low · CVSS 3.1 · Published 2023-03-30

Technologies: angular (npm). Vendors: Google, npm.

Executive brief

AngularJS, a popular framework for building web applications, is vulnerable to a denial-of-service attack. By providing specially crafted, large inputs to certain data-copying functions, an attacker can cause the application to become unresponsive. This can lead to service outages or a degraded experience for legitimate users.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in AngularJS versions 1.2.21 through 1.8.3. The flaw is located within the angular.copy() utility function, which utilizes an insecure regular expression. An attacker can exploit this by providing a large, carefully-crafted input string that triggers catastrophic backtracking during regex evaluation. This results in excessive CPU consumption, leading to a denial-of-service condition. The vulnerability is reachable over the network without authentication, provided the application passes user-controlled input to the affected utility. Fixes are available in updated package versions provided by downstream maintainers like Debian and Fedora.

Affected products

  • Google angular >= 1.2.21, <= 1.8.3

Timeline

  • 2023-03-30: advisory: Initial publication of the GHSA advisory.
  • 2023-03-30: disclosed: NVD publication date.
  • 2025-07-20: patched: Debian LTS released a security update for angular.js.

References

Related threats