CVE-2022-37599
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
CVE-2022-37599- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
CVE List No score
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
CVE-2022-37599- Updated
- 2026-11-02
EUVDEUVD-2022-7107 No score
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
EUVD-2022-7107- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhq3-ff78-jv3g
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
A regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
- Record
GHSA-hhq3-ff78-jv3g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVGHSA-hhq3-ff78-jv3g
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
A regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
- Record
GHSA-hhq3-ff78-jv3g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-37599
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
UBUNTU-CVE-2022-37599- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVCLSA-2026-1774830262 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.2.3-tuxcare.1.
- Record
CLSA-2026-1774830262- Updated
- 2026-11-02
OSVCLSA-2026-1774830269 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 2.0.0-tuxcare.1.
- Record
CLSA-2026-1774830269- Updated
- 2026-11-02
OSVCLSA-2026-1776386119 No score
TuxCare security update for loader-utils (3 CVEs)
TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.1.0-tuxcare.1.
- Record
CLSA-2026-1776386119- Updated
- 2026-11-02
OSV No score
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
CVE-2022-37599- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-37599 No score
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Record
DEBIAN-CVE-2022-37599- Updated
- 2026-11-03
OSVMGASA-2025-0194 No score
Updated yarnpkg packages fix security vulnerabilities
CVE-2024-37890 yarnpkg: denial of service when handling a request with many HTTP headers. CVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature Verification. CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file And other vulnerabilities in the yarn's bundled nodejs components are fixed too, see the references.
- Record
MGASA-2025-0194- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-37599 No score
CVE-2022-37599 in loader-utils - Patched by Root
Root has patched CVE-2022-37599 in the loader-utils package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-37599- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loader-utilsnpm |
1.0.0 up to 1.4.2 | 1.4.2 |
loader-utilsnpm |
2.0.0 up to 2.0.4 | 2.0.4 |
loader-utilsnpm |
3.0.0 up to 3.2.1 | 3.2.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
1.2.3-tuxcare.0 up to 1.2.3-tuxcare.1, plus listed versions 1.2.3 |
1.2.3-tuxcare.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions 2.0.0 |
2.0.0-tuxcare.1 |
loader-utilsTuxCare:npm From an advisory covering 3 CVEs |
1.1.0-tuxcare.0 up to 1.1.0-tuxcare.1, plus listed versions 1.1.0 |
1.1.0-tuxcare.1 |
node-loader-utilsDebian:12 |
before 2.0.4-1 | 2.0.4-1 |
node-loader-utilsDebian:13 |
before 2.0.4-1 | 2.0.4-1 |
node-loader-utilsDebian:14 |
before 2.0.4-1 | 2.0.4-1 |
yarnpkgMageia:9 From an advisory covering 11 CVEs |
before 1.22.22-0.10.9.2.1.mga9 | 1.22.22-0.10.9.2.1.mga9 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
loader-utilsRoot:npm |
before 2.0.3-aikido.2 | 2.0.3-aikido.21.2.3-aikido.22.0.0-aikido.21.2.3-aikido.31.4.0-aikido.21.4.0-aikido.3 |
@rootio/loader-utilsRoot:npm |
before 2.0.3-root.io.2 | 2.0.3-root.io.21.2.3-root.io.22.0.0-root.io.21.2.3-root.io.31.4.0-root.io.21.4.0-root.io.3 |
node-loader-utilsUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.0-1 |
None known |
node-loader-utilsUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.0-21.2.3-1 |
None known |
node-loader-utilsUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.0-12.0.2-1ubuntu2 |
None known |
node-loader-utilsUbuntu:24.04:LTS |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:25.10 |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:26.10 |
All versions, plus listed versions 2.0.4-1 |
None known |
node-loader-utilsUbuntu:26.04:LTS |
All versions, plus listed versions 2.0.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37599 is a high vulnerability (CVSS 7.5) in Webpack.js Loader-utils, published October 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. Fixed in loader-utils 1.4.2.
References
github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-37599
security-tracker.debian.org/tracker/CVE-2022-37599
advisories.mageia.org/MGASA-2025-0194.html
bugs.mageia.org/show_bug.cgi?id=33674
ubuntu.com/security/CVE-2022-37599
cve.org/CVERecord?id=CVE-2022-37599