CVE-2022-37601

Prototype pollution in webpack loader-utils

9.8 CriticalFix available

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.50%Up 2.6 points since Oct 13, 2022

What each source reports

NVD Score used 9.8

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: CVE-2022-37601
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

CVE List No score

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: CVE-2022-37601
Updated: 2026-11-02

EUVDEUVD-2022-7042 No score

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: EUVD-2022-7042
Updated: 2026-11-03

GitHub AdvisoriesGHSA-76p3-8jx3-jpfq 9.8

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

Record: GHSA-76p3-8jx3-jpfq
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSVAZL-26161 9.8

CVE-2022-37601 affecting package reaper for versions less than 3.1.1-3

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: AZL-26161
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-37601 9.8

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: DEBIAN-CVE-2022-37601
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

Show 10 moreShow less

OSVGHSA-76p3-8jx3-jpfq 9.8

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

Record: GHSA-76p3-8jx3-jpfq
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSVRHSA-2023:6420 9.8

Red Hat Security Advisory: grafana security and enhancement update

Record: RHSA-2023:6420
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:6972 9.8

Red Hat Security Advisory: grafana security and enhancement update

Record: RHSA-2023:6972
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-37601 9.8

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: UBUNTU-CVE-2022-37601
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1773447386 No score

TuxCare security update for loader-utils (1 CVE)

TuxCare rebuilt loader-utils to address 1 CVE. Fixed in 0.2.17-tuxcare.1.

Record: CLSA-2026-1773447386
Updated: 2026-11-02

OSVCLSA-2026-1774830262 No score

TuxCare security update for loader-utils (3 CVEs)

TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.2.3-tuxcare.1.

Record: CLSA-2026-1774830262
Updated: 2026-11-02

OSVCLSA-2026-1774830269 No score

TuxCare security update for loader-utils (3 CVEs)

TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 2.0.0-tuxcare.1.

Record: CLSA-2026-1774830269
Updated: 2026-11-02

OSVCLSA-2026-1776386119 No score

TuxCare security update for loader-utils (3 CVEs)

TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.1.0-tuxcare.1.

Record: CLSA-2026-1776386119
Updated: 2026-11-02

OSV No score

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Record: CVE-2022-37601
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2022-37601 No score

CVE-2022-37601 in loader-utils - Patched by Root

Root has patched CVE-2022-37601 in the loader-utils package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2022-37601
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`loader-utils` npm	2.0.0 up to 2.0.3	2.0.3
`loader-utils` npm	before 1.4.1	1.4.1
`reaper` Azure Linux:2	before 3.1.1-3	3.1.1-3
`loader-utils` TuxCare:npm	0.2.17-tuxcare.0 up to 0.2.17-tuxcare.1, plus listed versions 0.2.17	0.2.17-tuxcare.1
`loader-utils` TuxCare:npm	1.2.3-tuxcare.0 up to 1.2.3-tuxcare.1, plus listed versions 1.2.3	1.2.3-tuxcare.1
`loader-utils` TuxCare:npm	2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions 2.0.0	2.0.0-tuxcare.1
`loader-utils` TuxCare:npm	1.1.0-tuxcare.0 up to 1.1.0-tuxcare.1, plus listed versions 1.1.0	1.1.0-tuxcare.1
`node-loader-utils` Debian:12	before 2.0.3-1	2.0.3-1
`node-loader-utils` Debian:13	before 2.0.3-1	2.0.3-1
`node-loader-utils` Debian:14	before 2.0.3-1	2.0.3-1

Show 16 moreShow less

Affected packages
Package	Affected	Fixed
`node-loader-utils` Debian:10	before 1.1.0-2+deb10u1, plus listed versions 1.1.0-2	1.1.0-2+deb10u1
`grafana` Red Hat:enterprise_linux:9::appstream	before 0:9.2.10-7.el9_3	0:9.2.10-7.el9_3
`grafana-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:9.2.10-7.el9_3	0:9.2.10-7.el9_3
`grafana-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:9.2.10-7.el9_3	0:9.2.10-7.el9_3
`grafana` Red Hat:enterprise_linux:8::appstream	before 0:9.2.10-7.el8_9	0:9.2.10-7.el8_9
`grafana-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:9.2.10-7.el8_9	0:9.2.10-7.el8_9
`grafana-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:9.2.10-7.el8_9	0:9.2.10-7.el8_9
`loader-utils` Root:npm	before 0.2.17-aikido.2	0.2.17-aikido.21.2.3-aikido.11.2.3-aikido.22.0.0-aikido.11.2.3-aikido.31.4.0-aikido.11.4.0-aikido.21.4.0-aikido.32.0.3-aikido.2
`@rootio/loader-utils` Root:npm	before 0.2.17-root.io.1	0.2.17-root.io.10.2.17-root.io.21.2.3-root.io.11.2.3-root.io.22.0.0-root.io.11.2.3-root.io.31.4.0-root.io.11.4.0-root.io.21.4.0-root.io.32.0.3-root.io.2
`node-loader-utils` Ubuntu:18.04:LTS	All versions, plus listed versions 1.1.0-1	None known
`node-loader-utils` Ubuntu:20.04:LTS	All versions, plus listed versions 1.1.0-21.2.3-1	None known
`node-loader-utils` Ubuntu:22.04:LTS	All versions, plus listed versions 2.0.0-12.0.2-1ubuntu2	None known
`node-loader-utils` Ubuntu:24.04:LTS	All versions, plus listed versions 2.0.4-1	None known
`node-loader-utils` Ubuntu:25.10	All versions, plus listed versions 2.0.4-1	None known
`node-loader-utils` Ubuntu:26.10	All versions, plus listed versions 2.0.4-1	None known
`node-loader-utils` Ubuntu:26.04:LTS	All versions, plus listed versions 2.0.4-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37601 is a critical vulnerability (CVSS 9.8) in Webpack.js Loader-utils, published October 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.50%, the 89th percentile. Fixed in loader-utils 2.0.3.

References

Show 79 moreShow less