CVE-2025-4690: AngularJS Linky Filter ReDoS Vulnerability

CVE-2025-4690 Overview

CVE-2025-4690 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the AngularJS linky filter provided by the ngSanitize module. The filter uses a regular expression with catastrophic backtracking behavior to detect URLs in input text. Attackers can submit specially crafted input strings that trigger super-linear runtime, consuming CPU resources and degrading application availability. This issue affects all versions of AngularJS. The AngularJS project has reached End-of-Life status and will not receive an official patch. The vulnerability is categorized under CWE-1333 (Inefficient Regular Expression Complexity).

Critical Impact
A remote attacker can trigger sustained CPU consumption in browser or server-side AngularJS applications by submitting crafted text to the linky filter, resulting in denial of service.

Affected Products

AngularJS - all versions (End-of-Life)
Applications using the ngSanitize module's linky filter
Server-side rendering environments processing AngularJS templates

Discovery Timeline

2025-08-19 - CVE-2025-4690 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4690

Vulnerability Analysis

The linky filter in AngularJS's ngSanitize module converts plain-text URLs and email addresses into clickable HTML anchor tags. To locate these substrings, the filter relies on a regular expression that contains ambiguous quantifiers and overlapping character classes. When applied to a carefully crafted input string, the regex engine explores an exponential number of matching paths through backtracking.

The attacker does not need authentication. Any interface that passes user-controlled text through the linky filter becomes a delivery channel. Public comment sections, chat messages, form previews, and rendered profile fields are common exposure points.

Because AngularJS executes in the browser, a single victim triggering the filter locks up the rendering thread. When the filter runs on Node.js during server-side rendering, one request can pin a worker at 100 percent CPU. Repeated submissions amplify the impact into a full application outage.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333]. The URL-matching pattern used by linky contains nested quantifiers and alternations that produce a super-linear worst-case runtime. When input contains long repeating characters that partially match the pattern but fail at the end, the regex engine backtracks through every combination before failing.

Attack Vector

Exploitation requires a network-reachable AngularJS application that renders user-supplied text through the linky filter. The attacker submits a payload containing a long crafted string designed to maximize backtracking in the URL detection regex. User interaction is required to render the affected view, which is typical for shared content pages. No privileges or special access are needed. Proof-of-concept behavior is demonstrated in the HeroDevs CodePen test referenced in the HeroDevs CVE-2025-4690 advisory.

No verified exploit code is published in a public exploit database, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-4690

Indicators of Compromise

Sustained CPU utilization spikes in browser processes or Node.js workers rendering AngularJS templates.
Requests containing unusually long text fields with repeating characters targeting endpoints that use the linky filter.
Client-side page freezes or unresponsive script warnings correlated with viewing user-generated content.
Increased response times or timeouts on server-side rendered AngularJS routes.

Detection Strategies

Audit application source code for references to linky and the ngSanitize module to enumerate exposed rendering paths.
Instrument regex execution time in AngularJS applications and alert on filter invocations exceeding a bounded threshold.
Deploy Web Application Firewall (WAF) rules that flag input fields containing pathological repeating patterns typical of ReDoS payloads.

Monitoring Recommendations

Track per-request CPU time on server-side rendering workers and page render duration on the client.
Log input length and character-class distribution for fields that feed the linky filter to identify anomalous submissions.
Correlate spikes in event loop lag with specific user sessions or IP addresses submitting content.

How to Mitigate CVE-2025-4690

Immediate Actions Required

Inventory all applications and libraries that depend on AngularJS and identify usage of the linky filter.
Enforce input length limits on any field rendered through linky to bound worst-case regex runtime.
Restrict access to affected pages or throttle submissions per source IP until a permanent fix is in place.
Plan migration away from AngularJS to a supported framework such as Angular or an alternative maintained equivalent.

Patch Information

No official patch will be released. The AngularJS project is End-of-Life as documented in the AngularJS version support status. Commercial extended support is available from HeroDevs, which provides patched builds addressing this issue. See the HeroDevs CVE-2025-4690 advisory for details on obtaining fixed distributions.

Workarounds

Replace the linky filter with a custom URL-detection implementation using a linear-time regex or a dedicated parser.
Pre-sanitize and truncate user input on the server before it reaches the AngularJS rendering pipeline.
Execute rendering in a sandboxed worker with an execution timeout that terminates runaway regex evaluation.
Disable rendering of user-generated content through linky on high-risk pages where feasible.

bash

# Example: enforce a maximum input length in an Express middleware
# before passing content to an AngularJS server-side render
app.use('/render', (req, res, next) => {
  const MAX_LEN = 2048;
  if (typeof req.body.text === 'string' && req.body.text.length > MAX_LEN) {
    return res.status(413).send('Input exceeds maximum allowed length');
  }
  next();
});