CVE-2024-21490

Name of the Vulnerable Software and Affected Versions angular versions 1.3.0 and later

Description A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Recommendations For versions 1.3.0 and later, migrate to @angular/core as the package is EOL and will not receive any updates to address this issue. As a temporary workaround, consider restricting the use of the ng-srcset directive until a patch is available.