CVE-2022-37603
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in webpack's loader-utils allows attackers to crash the build process by sending specially crafted input strings that cause the regex engine to hang. This can disrupt development workflows and continuous integration pipelines.
A ReDoS vulnerability exists in the interpolateName function of loader-utils 2.0.0, where the url parameter is processed by a vulnerable regular expression pattern. An attacker can supply a malformed URL string to trigger exponential backtracking in the regex engine, causing denial of service during webpack builds without requiring authentication or special privileges.