CVE-2022-37599
HIGHwebpack.js loader-utils 1.0.0-1.4.1 - Regular Expression Denial of Service in interpolateName Function
Title source: llmDescription
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
References (7)
Core 7
Core References
Third Party Advisory
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38
Third Party Advisory
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83
Issue Tracking, Third Party Advisory
https://github.com/webpack/loader-utils/issues/211
Issue Tracking, Patch, Third Party Advisory
https://github.com/webpack/loader-utils/issues/216
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
Scores
CVSS v3
7.5
EPSS
0.0206
EPSS Percentile
78.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-1333
Status
published
Products (2)
npm/loader-utils
1.0.0 - 1.4.2npm
webpack.js/loader-utils
1.0.0 - 1.4.2
Published
Oct 11, 2022
Tracked Since
Feb 18, 2026