CVE-2022-37599: loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.89291%
CWE
Published
10/12/2022
Updated
4/22/2024
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| loader-utils | npm | >= 1.0.0, < 1.4.2 | 1.4.2 |
| loader-utils | npm | >= 2.0.0, < 2.0.4 | 2.0.4 |
| loader-utils | npm | >= 3.0.0, < 3.2.1 | 3.2.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability was explicitly tied to the interpolateName function handling resourcePath through a vulnerable regex pattern. The GitHub patch shows the regex was modified from [^:]] to [^[]:] in the capture group, specifically to prevent ReDoS by reducing backtracking complexity. Multiple sources (CVE description, commit diff, advisory references) all point to this function and regex as the attack vector. The function's role in processing untrusted resourcePath values makes it the clear entry point for crafted malicious inputs.