UNKNOWNCVE-2022-37599
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
Platform
nodejs
Component
loader-utils
Fixed in
1.4.2
A regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Monitor your dependencies automatically
Get notified when new vulnerabilities affect your projects. Free forever.
Start free