GitHub Advisoryadvisory · npm

GHSA-3rfm-jhwj-7488 loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

HIGH Published 2022-10-14 Modified 2022-11-15 Official page ↗
Aliases
CVE-2022-37603
Ecosystem
npm
Packages
loader-utils
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2022-11-15

Affected packages

• npm loader-utils: >= 1.0.0, < 1.4.2 → fixed in 1.4.2 • npm loader-utils: >= 2.0.0, < 2.0.4 → fixed in 2.0.4 • npm loader-utils: >= 3.0.0, < 3.2.1 → fixed in 3.2.1

Description

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.

Related

Alias · CVE (1)

  • CVE-2022-37603 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References