Is angular 1.8 vulnerable?

npm · 4 releases from 1.8.0 to 1.8.3 · latest angular is 1.8.3 · checked 1 Nov 2026

Yes: 10 known advisories

Yes. angular 1.8.3, the last 1.8 release, is affected by 10 known security advisories (2 high, 5 medium, 3 low), including CVE-2026-11998, CVE-2024-21490, CVE-2023-26117. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting angular 1.8.3

  • HighCVE-2026-11998GHSA-7x27-g8rg-x87w24 Jun 2026

    Angular's deprecated package has a Cross-Site Scripting issue

    Affected
    >=1.2.0-rc.3 <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2025-0716GHSA-j58c-ww9w-pwp529 Apr 2025

    AngularJS improperly sanitizes SVG elements

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2024-8372GHSA-m9gf-397r-hwpg9 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    >=1.3.0-rc.4 <=1.8.3
    Fixed in
    No fix released
  • LowCVE-2024-8373GHSA-mqm9-c95h-x2p69 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • HighCVE-2024-21490GHSA-4w4v-5hc9-xrr210 Feb 2024

    angular vulnerable to super-linear runtime due to backtracking

    Affected
    >=1.3.0 <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26117GHSA-2qqx-w9hr-q5gx30 Mar 2023

    angular vulnerable to regular expression denial of service via the $resource service

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26116GHSA-2vrf-hf26-jrp530 Mar 2023

    angular vulnerable to regular expression denial of service via the angular.copy() utility

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2023-26118GHSA-qwqh-hm9m-p5hr30 Mar 2023

    angular vulnerable to regular expression denial of service via the <input type="url"> element

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2022-25869GHSA-prc3-vjfx-vhm916 Jul 2022

    Angular (deprecated package) Cross-site Scripting

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumCVE-2022-25844GHSA-m2h2-264f-f4863 May 2022

    angular vulnerable to regular expression denial of service (ReDoS)

    Affected
    >=1.7.0
    Fixed in
    No fix released

Which of your client projects are still on angular 1.8?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact angular version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other angular versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.