CVE-2024-21490

Summary

CVE-2024-21490 is a denial-of-service vulnerability affecting versions of the Angular package, specifically those below 1.3.0. The issue stems from a problematic regular expression used to process the ng-srcset directive. Maliciously crafted inputs can induce super-linear runtime due to backtracking, ultimately leading to catastrophic backtracking and a denial-of-service condition. Unfortunately, this package has reached its end-of-life and will not receive any further updates. Users are advised to migrate to [@angular/core](https://www.npmjs.com/package/@angular/core) to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.