CVE-2025-4690 AngularJS 'linky' filter ReDoS
Attackers can cause denial of service in applications using AngularJS via ReDoS in the linky filter; the library is end-of-life with no fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4690?
CVE-2025-4690 is a medium-severity denial of service vulnerability in Google AngularJS, published on 19 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a
Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application.
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Weakness: CWE-1333
Which versions are affected by CVE-2025-4690?
How do I fix CVE-2025-4690?
Product is end of life, replace it.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-4690 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4690 exists.
Sources
Also known as CLSA-2026-1785554487, CLSA-2026-1785554488, DEBIAN-CVE-2025-4690, GHSA-hfff-63hg-f47j, UBUNTU-CVE-2025-4690.