Production-ready security patches for AngularJS 1.x — All 12 known CVEs patched. Zero code changes required. Open source alternative to $15K–$50K/year commercial support.
AngularJS reached End-of-Life in January 2022. Google stopped all maintenance and security updates.
Yet the framework still has:
- ~2 million monthly downloads on npm
- Thousands of production applications in Fortune 500 companies
- 11 unpatched security vulnerabilities (2 HIGH, 9 MEDIUM severity)
- No official migration path that doesn't require a complete rewrite
Most enterprises face three bad options:
- Stay on 1.8.3 with known CVEs → fails security audits, compliance reviews
- Rewrite to modern Angular/React/Vue → $500K+ and 12–24 months
- Pay $15K–$50K+/year for commercial Extended Support
@brickhouse-tech/angular-lts is a community-maintained fork that patches all known security vulnerabilities in AngularJS 1.x.
✅ All 12 CVEs patched — 3 HIGH, 9 MEDIUM severity vulnerabilities fixed
✅ Drop-in replacement — Same API, same behavior, zero code changes
✅ MIT licensed — Free and open source, forever
✅ Actively maintained — CI/CD, npm provenance, GitHub security advisories
✅ Production-ready — Latest version 1.10.2 on npm
One command. Zero refactoring. Full security compliance.
| # | Vulnerability ID | Severity | CVSS | Vulnerability Type | Status |
|---|---|---|---|---|---|
| 1 | SNYK-JS-ANGULAR-9919773 | Medium | 5.3 | Incomplete Filtering (SVG href) | ✅ Fixed in 1.8.4+ |
| 2 | SNYK-JS-ANGULAR-7924843 | Medium | 5.3 | srcset bypass | ✅ Fixed in 1.8.4+ |
| 3 | SNYK-JS-ANGULAR-7924842 | Medium | 5.3 | srcset source spoofing | ✅ Fixed in 1.8.4+ |
| 4 | SNYK-JS-ANGULAR-6091113 | High | 7.5 | ReDoS ng-srcset | ✅ Fixed in 1.8.4+ |
| 5 | SNYK-JS-ANGULAR-3373044 | Medium | 5.3 | ReDoS angular.copy() | ✅ Fixed in 1.8.4+ |
| 6 | SNYK-JS-ANGULAR-3373046 | Medium | 5.3 | ReDoS input[type=url] | ✅ Fixed in 1.8.4+ |
| 7 | SNYK-JS-ANGULAR-3373045 | Medium | 5.3 | ReDoS $resource | ✅ Fixed in 1.8.4+ |
| 8 | SNYK-JS-ANGULAR-2949781 | Medium | 6.1 | XSS textarea (IE) | ✅ Fixed in 1.8.4+ |
| 9 | SNYK-JS-ANGULAR-2772735 | Medium | 5.3 | ReDoS DATE_FORMATS | ✅ Fixed in 1.8.4+ |
| 10 | CVE-2022-25869 | Medium | 6.1 | $sanitize bypass style (IE/Edge) | ✅ Fixed in 1.8.4+ |
| 11 | CVE-2022-25844 / CVE-2020-7676 / CVE-2020-7212 | High+Medium | 7.5 | ReDoS + XSS + Proto Pollution | ✅ Fixed in 1.8.4+ |
| 12 | CVE-2026-11998 | High | 7.6 | SCE resource URL policy bypass (XSS) | ✅ Fixed in 1.10.3+ |
All patches tested and verified. Full details in SECURITY.md.
npm uninstall angularnpm install @brickhouse-tech/angular-ltsThat's it. No code changes. No configuration. No build changes. Same API, same behavior, just patched.
Your package.json should now show:
{
"dependencies": {
"@brickhouse-tech/angular-lts": "^1.10.2"
}
}If you're using a CDN, point to:
<scriptsrc="https://unpkg.com/@brickhouse-tech/angular-lts@1.10.2/angular.min.js"></script>HeroDevs offers commercial Extended Support for AngularJS (NES). It's a solid option for enterprises that need vendor backing. But it's expensive — and unnecessary for most teams.
| Feature | @brickhouse-tech/angular-lts | HeroDevs NES |
|---|---|---|
| Price | Free (MIT) | $15,000–$50,000+/year |
| Security patches | ✅ All 12 CVEs patched | ✅ All known CVEs patched |
| Drop-in replacement | ✅ Zero code changes | ✅ Zero code changes |
| Open source | ✅ MIT license, public repo | ❌ Proprietary, closed source |
| npm package | ✅ Public npm | ✅ Private npm registry |
| Community support | ✅ GitHub issues | ❌ Paid support only |
| SLA | ❌ Best-effort (Enterprise tier available) | ✅ Contractual SLA |
| Custom patches | ❌ (Enterprise tier available) | ✅ Custom backports |
| Compliance docs | ❌ (Enterprise tier available) | ✅ Audit reports, attestations |
Bottom line: If you just need the CVEs patched, use @brickhouse-tech/angular-lts and save $15K–$50K/year. If you need vendor SLAs and compliance paperwork, consider our Enterprise tier or HeroDevs.
Need more than open source patches? We offer commercial support tiers for teams that require SLAs, priority patches, or custom backports.
| Tier | Price | What You Get |
|---|---|---|
| Community | Free | Open source patches, GitHub issues, npm package |
| Professional | $500/month | 48-hour SLA, private Slack channel, priority bug fixes |
| Enterprise | $5,000/month | 4-hour SLA, custom patches, compliance documentation, audit support |
This fork is maintained by Brickhouse Tech and community contributors. If your organization depends on AngularJS, consider sponsoring to ensure continued maintenance and faster patch releases.
Every contribution helps keep this project alive for the thousands of teams still running AngularJS in production.
- Upstream: Based on
angular@1.8.3(final official release) - Current version:
1.10.2(includes all security patches) - Testing: CI via GitHub Actions, tested on Node 20+
- Publishing: OIDC npm publishing with provenance attestation
- License: MIT (same as original AngularJS)
- npm:@brickhouse-tech/angular-lts
- Demo:https://brickhouse-tech.github.io/angular-lts-demo/
- Security advisories:SECURITY.md
- Original project:angular/angular.js (archived)
- GitHub Sponsors:https://github.com/sponsors/brickhouse-tech
- Enterprise Support:https://brickhouse-tech.lemonsqueezy.com
MIT — same as the original AngularJS project. See LICENSE for full text.
Built with ❤️ by Brickhouse Tech and community contributors.