CVE-2022-25844

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25844.json"

unresolved_ranges

[
    {
        "events":  [
            {
                "introduced":  "1.7.0"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "35"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "36"
            }
        ]
    }
]