npm/loader-utils CVE-2022-37603: high 7.5, EPSS 2.70%
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
Action: Upgrade loader-utils to 1.4.2 or later.
npm i loader-utils@1.4.2npm i loader-utils@2.0.4npm i loader-utils@3.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.4.2 | - |
| 2.0.0 | 2.0.4 | - |
| 3.0.0 | 3.2.1 | - |
Fixed versions
| 1.4.2 | 2.0.4 | 3.2.1 |
Sources
- osv: GHSA-3rfm-jhwj-7488
- https://nvd.nist.gov/vuln/detail/CVE-2022-37603
- https://github.com/webpack/loader-utils/issues/213
- https://github.com/webpack/loader-utils/issues/216
- https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa
- https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb
- https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1
- https://github.com/webpack/loader-utils
- https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107
- https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU
CVE-2022-37603 · published · modified · JSON