AngularJS end of life: the record, four years on

When did AngularJS reach end of life?

AngularJS reached end of life in January 2022. Google announced the cutoff for December 31, 2021, and stopped publishing patches and security fixes for every 1.x release after that date. The final version line, 1.8.x, is frozen. Every AngularJS application still running in 2026 has been unsupported for more than four years.

The naming matters, because two products share the word. AngularJS is the 1.x line. Angular — versions 2 and above — is a different framework from the same vendor: different language, different compiler, different rendering architecture. Angular is actively maintained. AngularJS is not, and no 1.x release, including the final one, receives fixes of any kind.

This is not a soft deprecation. End of life here means the formal end of Google’s long-term-support window. There is no security team accepting reports against AngularJS, no backport channel, and no paid tier from the vendor that changes the answer. Every advisory published since January 2022 — at least eight to date — carries the same disposition: no patch, and none coming.

Four years is long enough that the question has shifted. In 2022 the question was when to migrate. In 2026 the question is what the accumulated exposure looks like, and whether the remaining paths off the framework are credible. The next three sections take those in order.

Is it safe to keep running AngularJS in production in 2026?

No. AngularJS has accumulated at least eight public security advisories since support ended, and none will ever be patched. The list includes sanitization bypasses and regular-expression denial-of-service vectors, several affecting every version of the framework. The most recent advisory landed in June 2026 — four and a half years after end of life — and, like the rest, its fix status is permanent: none.

Three entries deserve particular attention. CVE-2025-4690, a regular-expression denial of service in ngSanitize’s linky filter, is formally marked WONTFIX — an explicit statement that no fix is coming for any version. CVE-2025-2336 and CVE-2025-0716 both bypass the SVG sanitization that AngularJS applications rely on to keep untrusted markup inert. The sanitizer is the control; the control has published holes.

The dates are the pattern worth reading. Three CVEs in 2023. One in 2024. Three in 2025. A fresh advisory in June 2026. Discovery did not stop when patching did — it continued at a steady cadence, and every new entry is permanent on arrival. There is no reason to expect the ledger above is complete; there is every reason to expect it grows.

What does AngularJS end of life mean for compliance?

PCI DSS 4.0 treats end-of-life software as a control failure, not as a risk to be accepted and documented away. An AngularJS front end in a cardholder-data environment is a findable, citable audit exception. Outside PCI, the same fact surfaces in vendor security questionnaires, penetration-test reports, and technical due diligence — an EOL framework with permanent unpatched CVEs is a standard finding in all three.

The exposure arrives through four routine channels, none of which require an attacker.

• Assessments. PCI DSS 4.0 expects in-scope components to be supported and patchable. An EOL framework fails that expectation outright, and the ledger above supplies the assessor’s citations.
• Security questionnaires. Enterprise procurement asks directly about software past end of support. AngularJS is detectable from the page source in under a minute, so the answer is independently checkable.
• Penetration tests. An EOL framework with public unpatched CVEs is a stock finding. It recurs in every retest, unfixable, until the framework is gone.
• Technical due diligence. Acquirers and investors price remediation into the deal. An unmigrated AngularJS estate becomes a line item with someone else’s number attached — and by typical published quotes, that number starts at $500K for a hand rewrite.

None of these channels care whether the application works. It can render perfectly, keep users happy, and carry revenue — the finding gets written anyway, because the finding is about patchability, not functionality. That distinction is why the problem compounds silently in organizations where the app is stable and nobody wants to touch it.

What are the options for an AngularJS app in 2026?

Four. Do nothing and absorb the risk. Buy extended support, which rents patch coverage at published rates of $25K–$75K per year while the app stays AngularJS. Rewrite by hand, at published quotes of $500K+ and 12–24 months. Or run an automated, compiler-aware migration that converts the existing codebase and proves the result compiles and renders. The full comparison lives at the options page.

Extended support is the honest middle case and deserves an honest description. HeroDevs NES and OpenLogic ship private patches for known issues, which genuinely addresses the ledger above for subscribers. What a subscription cannot do is change the trajectory: the application is still AngularJS, still aging, still hard to hire for, and the cost repeats every year without converging on an exit. It rents time. Rented time is worth paying for exactly when it is spent executing a migration.

The rewrite paths and the migration path differ in kind, not only in price. A rewrite re-derives the application from observed behavior, which is why published quotes run to $500K+ and 12–24 months. A compiler-aware migration converts the code that already exists and checks each result against the TypeScript compiler and a real rendering browser as it goes. The comparison of all four paths, including their failure modes, is at /angularjs-migration-options/; the cost arithmetic is at /angularjs-migration-cost/.

Why is AI-era vulnerability discovery accelerating the risk?

Because vulnerability discovery is now industrial on both sides. Automated analysis reads old code faster and more cheaply than at any point in the framework’s life, and attackers run the same class of tooling as researchers. A maintained framework converts each discovery into a patch. End-of-life code converts each discovery into a permanent, documented entry point. AngularJS stopped converting in January 2022.

Newly disclosed vulnerabilities are now exploited quickly — in some cases before public disclosure. For maintained software, that compresses the window between advisory and patch. For EOL software there is no window to compress. The patch never arrives, so the exposure created on the day of discovery is the exposure years later.

AngularJS’s own ledger shows the input side of this already running: eight advisories in the four years since support ended, the newest in mid-2026, against a codebase that has not changed. The same tooling shift that makes it economical to migrate old code at scale makes it economical to mine old code for flaws at scale. Only one of those activities has a countermeasure, and the countermeasure is leaving.

What does a verified exit from AngularJS look like?

Our position: we don’t claim turnkey. We start with proof. In our reference run, 745 files of a production AngularJS ERP — 412 controllers, 138 directives, 96 services, 301 templates — were migrated in 24 hours elapsed. 100% of emitted files compile under strict TypeScript. 87 of 87 routes render-verified in a real browser with zero console errors. 11 files were flagged for human review rather than silently converted.

The pipeline is described in engineering terms on the homepage; the property that matters for this page is that it refuses to guess. Unconvertible template attributes are reported as skipped, never converted on a hunch. Unparseable templates are left byte-untouched with a recorded reason. The type engine emits explicit unsupported markers instead of widening to any. A coverage census degrades the final verdict if any source file is silently dropped. The failure modes are designed to be loud.

The engagement is fixed scope, priced by the module: audit → convert → verify → train your team → hand over. It asks about 2 hours of your team’s time up front, and reviewing the flagged list typically takes half a day. Regulated codebases run inside your VPC. The output is plain Angular in a standard CLI workspace — no proprietary runtime, no telemetry, nothing to license after handover. Every run ships an issue registry listing each flagged file with its reason and a suggested owner; the report format is documented at /angularjs-migration-report/.

If an estate is still on AngularJS in 2026, the ledger at the top of this page is the argument, and it only lengthens. The cheapest time to leave was 2021. The second cheapest is before the next advisory.

What else do teams ask about AngularJS end of life?

Does extended support make AngularJS safe?

It narrows the exposure without ending it. Vendors such as HeroDevs NES and OpenLogic ship private patches for known issues at published rates of $25K to $75K per year. The framework itself remains end of life upstream, the app remains AngularJS, and the subscription repeats every year. Extended support is a reasonable bridge while a migration runs; it is not a destination.

Will AngularJS apps stop working?

No. Browsers still execute AngularJS, and nothing switches off in 2026. The risk is different: security advisories that will never be patched, a sanitizer with known bypasses, compliance findings under PCI DSS 4.0, and a shrinking pool of engineers willing to maintain a framework that reached end of life in January 2022.

How long does migrating off AngularJS take?

Our reference run converted 745 files of a production AngularJS ERP in 24 hours elapsed: 412 controllers, 138 directives, 96 services, and 301 templates. Machine time is not the whole project. Plan on roughly 2 hours of your team's time up front and typically half a day to review the flagged-file list; the reference run flagged 11 files.

Is ngUpgrade enough?

ngUpgrade runs AngularJS and Angular side by side in one application. It is a bridge, not an exit: you ship both frameworks, maintain both change-detection systems, and the AngularJS half keeps every entry in the unpatched CVE ledger for as long as the hybrid lives. It is useful for an incremental cutover, not as a place to stop.