{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.3.0","last_affected":"1.8.3"}],"component":"angular","cve_ids":["CVE-2024-21490"],"ecosystem":"npm","epss":0.01891,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4w4v-5hc9-xrr2","id":"tcs_01M5KF1NH6ZSMXPB8ENNQVXZ9R","modified_at":"2026-09-10T03:50:09.714122064Z","published_at":"2024-02-10T06:30:19Z","references":["https://osv.dev/vulnerability/GHSA-4w4v-5hc9-xrr2","https://nvd.nist.gov/vuln/detail/CVE-2024-21490","https://github.com/angular/angular.js","https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747","https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113","https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos","https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4w4v-5hc9-xrr2","url":"https://osv.dev/vulnerability/GHSA-4w4v-5hc9-xrr2"}],"summary":"angular vulnerable to super-linear runtime due to backtracking"}