CVE-2022-37603
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
CVE-2022-37603- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
CVE List
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
CVE-2022-37603- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2022-7006
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
EUVD-2022-7006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3rfm-jhwj-7488
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
- Record
GHSA-3rfm-jhwj-7488- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
CVE-2022-37603- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-3rfm-jhwj-7488
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
- Record
GHSA-3rfm-jhwj-7488- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
Show 9 moreShow less
OSVRHSA-2023:1043
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
- Record
RHSA-2023:1043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:1044
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8
- Record
RHSA-2023:1044- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:1045
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
- Record
RHSA-2023:1045- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-37603
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
UBUNTU-CVE-2022-37603- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1774830262 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.2.3-tuxcare.1.
- Record
CLSA-2026-1774830262- Updated
- 2026-11-02
OSVCLSA-2026-1774830269 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 2.0.0-tuxcare.1.
- Record
CLSA-2026-1774830269- Updated
- 2026-11-02
OSVCLSA-2026-1776386119 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.1.0-tuxcare.1.
- Record
CLSA-2026-1776386119- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-37603 No score
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Record
DEBIAN-CVE-2022-37603- Updated
- 2026-11-03
OSVROOT-APP-NPM-CVE-2022-37603 No score
CVE-2022-37603 in loader-utils - Patched by Root
Root has patched CVE-2022-37603 in the loader-utils package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-37603- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loader-utilsnpm |
1.0.0 up to 1.4.2 | 1.4.2 |
loader-utilsnpm |
2.0.0 up to 2.0.4 | 2.0.4 |
loader-utilsnpm |
3.0.0 up to 3.2.1 | 3.2.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
1.2.3-tuxcare.0 up to 1.2.3-tuxcare.1, plus listed versions 1.2.3 |
1.2.3-tuxcare.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions 2.0.0 |
2.0.0-tuxcare.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
1.1.0-tuxcare.0 up to 1.1.0-tuxcare.1, plus listed versions 1.1.0 |
1.1.0-tuxcare.1 |
node-loader-utilsDebian:12 |
before 2.0.4-1 | 2.0.4-1 |
node-loader-utilsDebian:13 |
before 2.0.4-1 | 2.0.4-1 |
node-loader-utilsDebian:14 |
before 2.0.4-1 | 2.0.4-1 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el7sso | 0:18.0.6-1.redhat_00001.1.el7sso |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el7sso | 0:18.0.6-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el8sso | 0:18.0.6-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el8sso | 0:18.0.6-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el9sso | 0:18.0.6-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el9sso | 0:18.0.6-1.redhat_00001.1.el9sso |
loader-utilsRoot:npm |
before 2.0.3-aikido.2 | 2.0.3-aikido.22.0.0-aikido.21.2.3-aikido.31.4.0-aikido.3 |
@rootio/loader-utilsRoot:npm |
before 2.0.3-root.io.2 | 2.0.3-root.io.22.0.0-root.io.21.2.3-root.io.31.4.0-root.io.3 |
node-loader-utilsUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.0-1 |
None known |
node-loader-utilsUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.0-21.2.3-1 |
None known |
node-loader-utilsUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.0-12.0.2-1ubuntu2 |
None known |
node-loader-utilsUbuntu:24.04:LTS |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:25.10 |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:26.10 |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:26.04:LTS |
All versions, plus listed versions 2.0.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37603 is a high vulnerability (CVSS 7.5) in Webpack.js Loader-utils, published October 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 86th percentile. Fixed in loader-utils 1.4.2.
References
github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375
nvd.nist.gov/vuln/detail/CVE-2022-37603
Show 162 moreShow less
security-tracker.debian.org/tracker/CVE-2022-37603
access.redhat.com/errata/RHSA-2023:1043
bugzilla.redhat.com/show_bug.cgi?id=1601614
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json
cve.org/CVERecord?id=CVE-2018-14040
blog.jquery.com/2019/04/10/jquery-3-4-0-released
drupal.org/sa-core-2019-006
cisa.gov/known-exploited-vulnerabilities-catalog
security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
bitbucket.org/snakeyaml/snakeyaml/issues/525
mail-archive.com/[email protected]/msg39312.html
lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c
cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2
ubuntu.com/security/CVE-2022-37603