CVE-2022-37603: Webpack.js Loader-Utils

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Affected products

• Webpack.js Loader-Utils: before 1.4.2 (fixed in 1.4.2); from 2.0.0, before 2.0.4 (fixed in 2.0.4); from 3.0.0, before 3.2.1 (fixed in 3.2.1)

Published 2022-10-14. Last modified 2026-06-17.