CVE-2025-4690: Google AngularJS · ReDoS
Affects Google AngularJSSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium · end of life, no fix coming : replace or isolate Google AngularJS; no fix will be released.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- None coming – the product is end of life
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 19 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
No fix will be released: Google AngularJS is end of life. Replace it, or isolate it from untrusted networks until you can.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Google AngularJS | Affected
| Fixed in– |
AI-suggested
Given the lack of official patches due to AngularJS's EOL status, European organizations should adopt a multi-layered mitigation approach: 1) Identify and inventory all applications using AngularJS, especially those utilizing the ngSanitize linky filter. 2) Where feasible, refactor or upgrade applications to use supported frameworks such as Angular (2+) or other modern alternatives that do not suffer from this vulnerability. 3) Implement input validation and sanitization at the server side to limit the size and complexity of user inputs, particularly those that trigger URL detection. 4) Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious payloads that may exploit the regex inefficiency. 5) Monitor application performance metrics and logs to detect abnormal CPU usage patterns indicative of ReDoS attempts. 6) Consider rate limiting and CAPTCHA challenges on input forms to reduce automated attack attempts. 7) For legacy systems that cannot be immediately upgraded, isolate them in segmented network zones and restrict exposure to untrusted users. These targeted mitigations go beyond generic advice by focusing on compensating controls and proactive detection tailored to this specific regex-based DoS vector.
Description
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .