CVE-2022-25844: angularjs
Vulnerability summary
CVE-2022-25844 is a high (CVSS 7.5) vulnerability in angularjs. EPSS estimates a 4.93% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 5 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 01-05-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
CVSS metrics
8 scores · 7 sources · 2 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:FDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.93%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.93% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Angularjs1 product
- angularjs≥ 1.7.0 (No fix recorded)
Chainguard1 product
- solr< 9.10.0-r0
Debian1 product
- angular.js< 1.8.3-1+deb12u1 | < 1.8.3-2
Fedoraproject1 product
- fedoraEOL35 | 36
Mageia1 product
- glances< 3.3.1-1.1.mga8
Netapp1 product
Npm1 product
- angular≥ 1.7.0 (No fix recorded)
Ubuntu1 product
- angular.js< 1.7.9-1ubuntu0.1~esm1 | < 1.8.2-2ubuntu0.1 | < 1.8.3-1ubuntu0.24.04.1
Wolfi1 product
- solr< 9.10.0-r0
9 vendors · 9 products
References
23 links- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738REPORTEVIDENCEWEBExploitThird Party Advisory
