Is loader-utils 1.4 vulnerable?

npm · 3 releases from 1.4.0 to 1.4.2 · latest loader-utils is 3.3.1 · checked 1 Nov 2026

No known advisories in the last release

loader-utils 1.4.2, the last 1.4 release, has no known advisories. 3 advisories affect earlier 1.4.x releases, so update to 1.4.2.

Update within 1.4:npm install loader-utils@1.4.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 1.4.x, affecting earlier releases

  • HighCVE-2022-37603GHSA-3rfm-jhwj-748814 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1
  • CriticalCVE-2022-37601GHSA-76p3-8jx3-jpfq13 Oct 2022

    Prototype pollution in webpack loader-utils

    Affected
    >=2.0.0 <2.0.3 · <1.4.1
    Fixed in
    1.4.1, 2.0.3
  • HighCVE-2022-37599GHSA-hhq3-ff78-jv3g12 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1

Which of your client projects are still on loader-utils 1.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact loader-utils version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other loader-utils versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.