UNKNOWNCVE-2022-37603

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

Platform

nodejs

Component

loader-utils

Fixed in

1.4.2

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.

How to fix

No official patch available. Check for workarounds or monitor for updates.

Monitor your dependencies automatically

Get notified when new vulnerabilities affect your projects. Free forever.

Start free
CVE-2022-37603 — Vulnerability Details | NextGuard | NextGuard