CVE-2022-25844

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

• CWE-1333

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/
• https://security.netapp.com/advisory/ntap-20220629-0009/Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735Exploit, Third Party Advisory
• https://stackblitz.com/edit/angularjs-material-blank-zvtdvbExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/
• https://security.netapp.com/advisory/ntap-20220629-0009/Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735Exploit, Third Party Advisory
• https://stackblitz.com/edit/angularjs-material-blank-zvtdvbExploit, Third Party Advisory

Published

May 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25837Bluetooth® Pairing in Bluetooth Core Specification v1.0B thr…7.5
• CVE-2022-25838Laravel Fortify before 1.11.1 allows reuse within a short ti…8.1
• CVE-2022-25839The package url-js before 2.1.0 are vulnerable to Improper I…5.3
• CVE-2022-2584The dag-pb codec can panic when decoding invalid blocks.7.5
• CVE-2022-25841Uncontrolled search path elements in the Intel(R) Datacenter…7.8
• CVE-2022-25842All versions of package com.alibaba.oneagent:one-java-agent-…9.8
• CVE-2022-25845The package com.alibaba:fastjson before 1.2.83 are vulnerabl…9.8
• CVE-2022-25847All versions of the package serve-lite are vulnerable to Cro…6.1
• CVE-2022-25848This affects all versions of package static-dev-server. This…7.5
• CVE-2022-25849The package joyqi/hyper-down from 0.0.0 are vulnerable to Cr…6.1
• CVE-2022-2585It was discovered that when exec'ing from a non-leader threa…7.8
• CVE-2022-25850The package github.com/hoppscotch/proxyscotch before 1.0.0 a…7.5