Is loader-utils 2.0 vulnerable?

npm · 5 releases from 2.0.0 to 2.0.4 · latest loader-utils is 3.3.1 · checked 1 Nov 2026

No known advisories in the last release

loader-utils 2.0.4, the last 2.0 release, has no known advisories. 3 advisories affect earlier 2.0.x releases, so update to 2.0.4.

Update within 2.0:npm install loader-utils@2.0.4

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 2.0.x, affecting earlier releases

  • HighCVE-2022-37603GHSA-3rfm-jhwj-748814 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1
  • CriticalCVE-2022-37601GHSA-76p3-8jx3-jpfq13 Oct 2022

    Prototype pollution in webpack loader-utils

    Affected
    >=2.0.0 <2.0.3 · <1.4.1
    Fixed in
    1.4.1, 2.0.3
  • HighCVE-2022-37599GHSA-hhq3-ff78-jv3g12 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1

Which of your client projects are still on loader-utils 2.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact loader-utils version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other loader-utils versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.