Angular versions from 1.3.0 up to 1.8.3 contain a vulnerability in the ng-srcset directive where a regular expression used to split its value can cause super-linear runtime due to catastrophic backtracking. This can lead to denial of service when processing large, specially crafted inputs. The affected Angular package is end-of-life and will not receive updates; users are advised to migrate to @angular/core.