MediumGHSA-2vrf-hf26-jrp5CVE-2023-26116
angular vulnerable to regular expression denial of service via the angular.copy() utility
Published 30 Mar 2023 · Updated 10 Sept 2026
Affected package
angularnpm
- Affected
- <=1.8.3
- Fixed in
- No fix released
Details
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Is GHSA-2vrf-hf26-jrp5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected angular, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-26116
- Packagegithub.com/angular/angular.js
- Linklists.debian.org/debian-lts-announce/2025/07/msg00005.html
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321
- Linksecurity.snyk.io/vuln/SNYK-JS-ANGULAR-3373044
- Linkstackblitz.com/edit/angularjs-vulnerability-angular-copy-redos
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.