CVE-2022-37599: Webpack Loader-utils ReDoS Vulnerability

CVE-2022-37599 Overview

A Regular expression denial of service (ReDoS) vulnerability was discovered in the interpolateName function within interpolateName.js in webpack loader-utils version 2.0.0. The flaw exists in how the resourcePath variable is processed, allowing attackers to craft malicious input that causes catastrophic backtracking in the regular expression engine, leading to denial of service conditions.

Critical Impact

This ReDoS vulnerability can cause Node.js applications using webpack loader-utils to become unresponsive during build processes or runtime when processing specially crafted resource paths, potentially halting CI/CD pipelines and development workflows.

Affected Products

• webpack.js loader-utils 2.0.0
• Applications using vulnerable versions of loader-utils as a dependency
• Build systems and bundlers incorporating affected loader-utils versions

Discovery Timeline

• 2022-10-11 - CVE CVE-2022-37599 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2022-37599

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity). The interpolateName function in loader-utils is responsible for generating output filenames based on templates and resource paths. The regular expression patterns used within this function contain constructs that can lead to exponential time complexity when processing certain input strings.

When a maliciously crafted resourcePath value is passed to the interpolateName function, the regex engine enters a state of catastrophic backtracking. This occurs because the regex contains nested quantifiers or overlapping alternations that create an exponential number of possible matching paths, causing the CPU to become saturated while attempting to evaluate the expression.

The vulnerability is network-accessible as loader-utils may process user-controlled input in server-side rendering scenarios or when handling file uploads that influence resource paths.

Root Cause

The root cause lies in the regular expression patterns defined in interpolateName.js, specifically around line 38 and line 83. The patterns contain constructs susceptible to catastrophic backtracking when processing input strings with specific characteristics, such as long sequences of characters that partially match multiple parts of the pattern.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by providing a specially crafted resourcePath string to any application that passes user-controlled input to the interpolateName function. This could occur in scenarios such as:

• Web applications that allow users to upload files with custom names
• Build systems that process paths from external configuration sources
• Server-side rendering frameworks that generate asset names based on request parameters

The vulnerability causes high availability impact by exhausting CPU resources, though it does not compromise confidentiality or integrity of the system.

Detection Methods for CVE-2022-37599

Indicators of Compromise

• Unusually high CPU utilization on Node.js processes during webpack builds or runtime
• Build processes hanging indefinitely or timing out
• Application logs showing long processing times for file path interpolation operations
• Memory consumption spikes in processes using loader-utils

Detection Strategies

• Implement dependency scanning to identify webpack loader-utils version 2.0.0 in package.json or package-lock.json files
• Monitor Node.js process CPU usage patterns for sustained high utilization during build or request processing
• Use Software Composition Analysis (SCA) tools to flag vulnerable loader-utils versions in your dependency tree
• Set up alerting for build pipeline timeouts that may indicate ReDoS exploitation

Monitoring Recommendations

• Configure application performance monitoring (APM) to track regex execution times in affected code paths
• Implement timeout mechanisms for file path processing operations
• Monitor CI/CD pipeline execution times for anomalous increases
• Review application logs for repeated processing of similar resource path patterns

How to Mitigate CVE-2022-37599

Immediate Actions Required

• Audit all projects using webpack loader-utils by running npm ls loader-utils or checking dependency trees
• Update loader-utils to a patched version that addresses the ReDoS vulnerability
• Review any code that passes user-controlled input to the interpolateName function
• Implement input validation and length restrictions on resource paths before processing

Patch Information

Refer to the GitHub Issue #216 for vendor advisory information and patch details. Additional discussion of this vulnerability can be found in GitHub Issue #211. Fedora has also released package announcements addressing this vulnerability in their distribution repositories.

Workarounds

• Implement input validation to restrict the length and character set of resource paths before they reach the vulnerable function
• Add timeout wrappers around calls to interpolateName to prevent indefinite processing
• Use a Web Application Firewall (WAF) to filter requests containing potentially malicious path patterns
• Consider sandboxing build processes to limit the impact of CPU exhaustion attacks

# Identify vulnerable loader-utils versions in your project
npm ls loader-utils

# Update loader-utils to the latest patched version
npm update loader-utils

# For projects with locked dependencies, force update
npm install loader-utils@latest --save