UNKNOWNCVE-2022-37603
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
Platform
nodejs
Component
loader-utils
Fixed in
1.4.2
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Monitor your dependencies automatically
Get notified when new vulnerabilities affect your projects. Free forever.
Start free