Is loader-utils 1.3 vulnerable?

npm · 1 release from 1.3.0 to 1.3.0 · latest loader-utils is 3.3.1 · checked 1 Nov 2026

Yes: 3 known advisories

Yes. loader-utils 1.3.0, the last 1.3 release, is affected by 3 known security advisories (1 critical, 2 high), including CVE-2022-37601, CVE-2022-37603, CVE-2022-37599. Upgrade to 1.4.2 or later to fix all of them.

Upgrade with:npm install loader-utils@1.4.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting loader-utils 1.3.0

  • HighCVE-2022-37603GHSA-3rfm-jhwj-748814 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1
  • CriticalCVE-2022-37601GHSA-76p3-8jx3-jpfq13 Oct 2022

    Prototype pollution in webpack loader-utils

    Affected
    >=2.0.0 <2.0.3 · <1.4.1
    Fixed in
    1.4.1, 2.0.3
  • HighCVE-2022-37599GHSA-hhq3-ff78-jv3g12 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1

Which of your client projects are still on loader-utils 1.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact loader-utils version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other loader-utils versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.