Is angular 1.4 vulnerable?

npm · 15 releases from 1.4.0 to 1.4.14 · latest angular is 1.8.3 · checked 1 Nov 2026

Yes: 14 known advisories

Yes. angular 1.4.14, the last 1.4 release, is affected by 14 known security advisories (3 high, 8 medium, 3 low), including CVE-2026-11998, CVE-2024-21490, CVE-2019-10768. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting angular 1.4.14

  • HighCVE-2026-11998GHSA-7x27-g8rg-x87w24 Jun 2026

    Angular's deprecated package has a Cross-Site Scripting issue

    Affected
    >=1.2.0-rc.3 <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2025-0716GHSA-j58c-ww9w-pwp529 Apr 2025

    AngularJS improperly sanitizes SVG elements

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2024-8372GHSA-m9gf-397r-hwpg9 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    >=1.3.0-rc.4 <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2024-8373GHSA-mqm9-c95h-x2p69 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • HighCVE-2024-21490GHSA-4w4v-5hc9-xrr210 Feb 2024

    angular vulnerable to super-linear runtime due to backtracking

    Affected
    >=1.3.0 <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26117GHSA-2qqx-w9hr-q5gx30 Mar 2023

    angular vulnerable to regular expression denial of service via the $resource service

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26116GHSA-2vrf-hf26-jrp530 Mar 2023

    angular vulnerable to regular expression denial of service via the angular.copy() utility

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26118GHSA-qwqh-hm9m-p5hr30 Mar 2023

    angular vulnerable to regular expression denial of service via the <input type="url"> element

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2022-25869GHSA-prc3-vjfx-vhm916 Jul 2022

    Angular (deprecated package) Cross-site Scripting

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-5cp4-xmrw-59wf5 Aug 2020

    XSS via JQLite DOM manipulation functions in AngularJS

    Affected
    <1.8.0
    Fixed in
    1.8.0
  • MediumCVE-2020-7676GHSA-mhp6-pxh8-r67518 Jun 2020

    Angular vulnerable to Cross-site Scripting

    Affected
    <1.8.0
    Fixed in
    1.8.0
  • MediumCVE-2019-14863GHSA-r5fx-8r73-v86c14 Feb 2020

    AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

    Affected
    <1.5.0-beta.1
    Fixed in
    1.5.0-beta.1
  • HighCVE-2019-10768GHSA-89mq-4x47-5v8320 Nov 2019

    angular Prototype Pollution vulnerability

    Affected
    <1.7.9
    Fixed in
    1.7.9
  • MediumGHSA-28hp-fgcr-2r4h27 Jun 2019

    Cross-Site Scripting via JSONP

    Affected
    <1.6.0
    Fixed in
    1.6.0

Which of your client projects are still on angular 1.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact angular version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other angular versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.