loader-utils ist anfällig für Regular Expression Denial of Service (ReDoS)

An attacker exploiting CVE-2022-37599 can send crafted requests containing specially formatted strings that trigger a ReDoS condition. This can lead to a denial-of-service, rendering the system unresponsive or causing it to crash. The vulnerability's impact extends to any application utilizing webpack and the vulnerable version of loader-utils. While the attack requires crafting a specific input string, the potential for system-wide disruption makes this a significant concern. The blast radius includes any application relying on the vulnerable loader-utils library.

1. Reserviert2022-08-08
2. Veröffentlicht2022-10-11
3. Geändert2025-11-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-37599 is to upgrade webpack loader-utils to version 1.4.2 or later, 2.0.4 or later, or 3.2.1 or later. Review dependencies to ensure all related packages are also updated. Consider implementing input validation and sanitization to prevent malicious strings from reaching the vulnerable regular expression. While a WAF may not directly address ReDoS vulnerabilities, it can be configured to detect and block requests containing suspicious patterns. No specific Sigma or YARA rules are currently available, but monitoring for excessive CPU usage during webpack processing is recommended. After upgrading, confirm the fix by testing with known malicious input strings.

Zuletzt aktualisiert

3.3.1vor 23 Monaten