CVE-2024-21490
HighCVSS 7.5Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
This vulnerability affects angular package versions from 1.3.0 and angularjs package versions from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to catastrophic backtracking, leading to super-linear runtime. With large crafted input, this can cause a denial of service (DoS). The package is End-of-Life (EOL) and will not receive fixes.
Risk Assessment
The risk is a potential DoS attack via specially crafted requests, causing application unavailability. Since the package is EOL, organizations using it face a permanent threat without patching options.
Recommendation
Immediately plan migration from the EOL angular/angularjs package to @angular/core. Until migration, consider restricting access to ng-srcset functionality or implementing temporary WAF rules to block malicious inputs.
Other vulnerabilities in Angular
See all- CVE-2026-69151Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.
- CVE-2026-69149Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).
- CVE-2026-68945Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.
- CVE-2026-50556Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.
- CVE-2026-50555Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation dependency (domino) when serializing raw-text elements like <script>, <style>, and <iframe>. A Unicode index alignment bug causes dynamic text with astral characters (e.g., emojis) before a closing tag to be improperly escaped, allowing JavaScript injection. The flaw is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
- CVE-2026-54267Medium
A DOM Clobbering vulnerability in Angular allows an attacker to replace the SSR state container (ng-state) by injecting an HTML element with the same ID. During client hydration, Angular reads data from the fake element, potentially leading to code execution or data theft.
- CVE-2026-54266Medium
A vulnerability in Angular prior to versions 22.0.1, 21.2.17, and 20.3.25 allows an attacker to overwrite HTTP responses in the TransferState cache during Server-Side Rendering (SSR). The weak 32-bit DJB2 hash used for cache key generation enables hash collisions, causing sensitive endpoint responses to be replaced with responses from other requests.
- CVE-2026-50557Medium
A vulnerability in Angular's @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization via namespace workarounds. An attacker can inject a malicious template with custom namespaces, leading to client-side Cross-Site Scripting (XSS).
- CVE-2026-27970Medium
An XSS vulnerability in the Angular i18n pipeline allows arbitrary JavaScript execution if an attacker compromises the translation file. Affects versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 due to unsanitized HTML in ICU messages.
Original NVD description (English source)
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).