Packages / loader-utils / Security

HighVulnerabilityGHSA-3rfm-jhwj-7488CVE-2022-37603Published 14 Oct 2022

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

Affected releases · loader-utils

  • 3.x3.0.0 – 3.2.0Fixed in 3.2.1
  • 2.x2.0.0 – 2.0.3Fixed in 2.0.4
  • 1.x1.0.0 – 1.4.1Fixed in 1.4.2

On 3.x, the newest line:

npm install loader-utils@3.2.1
3.x

  1. Affected

    3.0.0 – 3.2.0

    6 releases

  2. Fixed

    3.2.1 – 3.3.1

    4 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.3

    4 releases

  2. Fixed

    2.0.4

    1 release

1.x

  1. Affected

    1.0.0 – 1.4.1

    13 releases

  2. Fixed

    1.4.2

    1 release

50 stable releases of loader-utils, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for loader-utils. It is read in your browser and sent nowhere.

What happens

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.