CVE-2022-25844
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 4.93% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1333
- Affected
- angularjs/angularjs · fedoraproject/fedora · netapp/ontap select deploy administration utility
- Source
- report@snyk.io
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/
- https://security.netapp.com/advisory/ntap-20220629-0009/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735Exploit, Third Party Advisory
- https://stackblitz.com/edit/angularjs-material-blank-zvtdvbExploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/
- https://security.netapp.com/advisory/ntap-20220629-0009/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735Exploit, Third Party Advisory
- https://stackblitz.com/edit/angularjs-material-blank-zvtdvbExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.