Regular Expression Denial Of Service (ReDoS)

2022-10-1621:39:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

loader-utils vulnerability

redos

remote attacker

denial of service

0.007 Low

EPSS

Percentile

80.3%

JSON

loader-utils is vulnerable to Regular Expression Denial Of Service (ReDoS). The vulnerability is due to insecure regular expression in the url variable of the interpolateName function in interpolateName.js. A remote attacker can cause denial of service via malicious regex.

CPENameOperatorVersion
loader-utilsle2.0.4
loader-utilsle2.0.3
loader-utilsle1.4.1
loader-utilsle3.2.0
org.webjars.npm:loader-utilseq0.2.17
node-loader-utils:sideq2.0.0-1
mozjs60eq60.9.0__3.el8
mozjs60eq60.9.0__4.el8
389-ds-baseeq1.4.3.16__19.module_el8.4.0+884+e9b25896
389-ds-baseeq1.4.3.36__1.module_el8+462+b1f840b3

Name	Operator	Version
loader-utils	le	2.0.4
loader-utils	le	2.0.3
loader-utils	le	1.4.1
loader-utils	le	3.2.0
org.webjars.npm:loader-utils	eq	0.2.17
node-loader-utils:sid	eq	2.0.0-1
mozjs60	eq	60.9.0__3.el8
mozjs60	eq	60.9.0__4.el8
389-ds-base	eq	1.4.3.16__19.module_el8.4.0+884+e9b25896
389-ds-base	eq	1.4.3.36__1.module_el8+462+b1f840b3