Is loader-utils 3.0 vulnerable?

npm · 1 release from 3.0.0 to 3.0.0 · latest loader-utils is 3.3.1 · checked 1 Nov 2026

Yes: 2 known advisories

Yes. loader-utils 3.0.0, the last 3.0 release, is affected by 2 known security advisories (2 high), including CVE-2022-37603, CVE-2022-37599. Upgrade to 3.2.1 or later to fix all of them.

Upgrade with:npm install loader-utils@3.2.1

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting loader-utils 3.0.0

  • HighCVE-2022-37603GHSA-3rfm-jhwj-748814 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1
  • HighCVE-2022-37599GHSA-hhq3-ff78-jv3g12 Oct 2022

    loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

    Affected
    >=1.0.0 <1.4.2 · >=2.0.0 <2.0.4 · >=3.0.0 <3.2.1
    Fixed in
    1.4.2, 2.0.4, 3.2.1

Which of your client projects are still on loader-utils 3.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact loader-utils version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other loader-utils versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.