# CVE-2023-26118: Angular regular expression denial of service in URL validation

Source: https://junglewise.ai/threats/cve-2023-26118-angular-regular-expression-denial-of-service-in-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26118 · Severity: low · CVSS 3.1 · Published 2023-03-30

Angular contains an insecure regular expression used to validate URL input fields. An attacker can send a carefully crafted malicious input to cause excessive CPU consumption and application slowdown, potentially disrupting service availability for legitimate users.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26118 being exploited in the wild.

**How severe is CVE-2023-26118?** Low severity, with a CVSS score of 3.1, published 30 March 2023.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,last_affected=1.8.3.

**Is there a fix for CVE-2023-26118?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-26118 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26118?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a Regular Expression Denial of Service (ReDoS) flaw affecting Angular's input[url] validation component. The vulnerable code uses an insecure regular expression that performs catastrophic backtracking when processing specially crafted input strings. The attack is network-reachable and requires no authentication or user interaction beyond submitting a malicious URL to a form field using the type="url" attribute. An attacker can trigger excessive CPU consumption, causing the application to hang or become unresponsive. All versions of Angular through 1.8.3 are affected.

## Affected products

- Google Angular through 1.8.3

## Identifiers

- CVE-2023-26118
- GHSA-qwqh-hm9m-p5hr

## Timeline

- 2023-03-30: disclosed: Published in GitHub Advisory Database
- 2023-03-30: advisory: NVD published CVE-2023-26118

## References

- [https://github.com/angular/angular.js](https://github.com/angular/angular.js)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)