Showing with 9 additions and 2 deletions.

+7 −0 CHANGELOG.md

+1 −1 lib/interpolateName.js

+1 −1 package.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [2.0.4](https://github.com/webpack/loader-utils/compare/v2.0.3...v2.0.4) (2022-11-11)
+
+
+### Bug Fixes
+
+* ReDoS problem ([#225](https://github.com/webpack/loader-utils/issues/225)) ([ac09944](https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb))
+
 ### [2.0.3](https://github.com/webpack/loader-utils/compare/v2.0.1...v2.0.3) (2022-10-20)
 
 

diff --git a/lib/interpolateName.js b/lib/interpolateName.js
@@ -108,7 +108,7 @@ function interpolateName(loaderContext, name, options) {
       // `hash` and `contenthash` are same in `loader-utils` context
       // let's keep `hash` for backward compatibility
       .replace(
-        /\[(?:([^:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
+        /\[(?:([^[:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
         (all, hashType, digestType, maxLength) =>
           getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))
       )

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "loader-utils",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "author": "Tobias Koppers @sokra",
   "description": "utils for webpack loaders",
   "dependencies": {