AngularJS Vulnerability Can Make Your Web App Freeze or Crash for Users

Vulnerability Explanation

The `linky` filter in AngularJS's `angular-sanitize` (ngSanitize) package uses a regular expression to detect URLs in user-supplied text. Due to an implementation bug, this regex exhibits super-linear (potentially exponential) runtime relative to input size when processing specially crafted strings. An attacker who can supply input to any template or code path that applies the `linky` filter — e.g., `{{ userInput | linky }}` — can trigger catastrophic backtracking in the JavaScript regex engine, monopolising the browser's main thread or crashing the application entirely. The attack requires no authentication beyond the ability to submit text to the affected field.

Root Cause

The regex in `linky.js` (lines ~131 and ~155) uses nested quantifiers or ambiguous alternation patterns that allow the regex engine to explore an exponential number of matching paths when the input is crafted to avoid a match. This is a classic ReDoS pattern: the engine backtracks exhaustively before concluding no match exists, consuming unbounded CPU time proportional to input length.

Technical Impact

Denial of service of the client-side application: the browser tab becomes unresponsive or crashes. In server-side rendering (SSR) scenarios using AngularJS, the Node.js process could be blocked, causing a full server-side denial of service. An unauthenticated attacker with access to any text input field that feeds the `linky` filter can trigger this condition.

Severity Justification

CVSS Medium (estimated 5.3–6.5). Impact is limited to availability (DoS); no data exfiltration or code execution is possible. Exploitability requires the `linky` filter to be applied to attacker-controlled input, which is a common but not universal pattern. AngularJS's EOL status means no official fix will be released, increasing long-term risk exposure.

Affected Components

• angular-sanitize (ngSanitize) — all versions of AngularJS (1.x)

Remediation Steps

1. Identify all usages of the `linky` filter in your templates and JavaScript code by searching for `| linky` in templates and `linkyFilter` or `$filter('linky')` in JS files.
2. If the `linky` filter is applied to user-controlled input, remove it or replace it with a safe, purpose-built URL-detection library that does not use vulnerable regex patterns (e.g., linkifyjs).
3. Add server-side and/or client-side input length validation to cap the maximum length of text processed by any AngularJS filter. This limits the worst-case backtracking time even if the vulnerable filter remains in place temporarily.
4. Plan and execute a migration away from AngularJS to a supported framework (modern Angular, React, or Vue). AngularJS reached end of life on December 31, 2021, and will receive no further security patches from Google or the community.
5. If migration is not immediately feasible, evaluate commercial extended support options (e.g., HeroDevs NES or TuxCare ELS for AngularJS) which provide backported security patches for EOL AngularJS versions.

Verification Steps

1. Search the codebase for all occurrences of `| linky` in HTML templates and `linkyFilter` / `$filter('linky')` in JavaScript to confirm scope of exposure.
2. For any identified usage, test with a long crafted input (e.g., a string of 50,000+ repeated characters designed to avoid URL matching) and observe whether the browser tab freezes — if it does, the vulnerability is confirmed.
3. After applying input length limits, re-run the same test and confirm the app remains responsive.
4. After migration to a supported framework, verify that `angular-sanitize` / `angular.js` packages are no longer present in the production bundle using your build tool's dependency output or a tool like `npm ls angular`.

Best Practices

• Never apply regex-based filters to unbounded user input without first enforcing a maximum input length at the server side.
• Treat any end-of-life dependency as a security liability — schedule migrations before vulnerabilities accumulate.
• Audit all AngularJS filter usages (`linky`, `$sanitize`, etc.) for attacker-controlled data paths as part of any security review.
• Use a dependency inventory tool (e.g., `npm audit`, Snyk, or Dependabot) to surface EOL and vulnerable packages continuously.