Description
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-loader-utils | 2.0.3-1 | — |
| Debian 13 | node-loader-utils | 2.0.3-1 | — |
| Debian 12 | node-loader-utils | 2.0.3-1 | — |
| Debian 10 | node-loader-utils | 1.1.0-2+deb10u1 | DLA-3258-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-loader-utils | No fix yet | — |
| Ubuntu 26.04 LTS | node-loader-utils | No fix yet | — |
| Ubuntu 25.10 | node-loader-utils | No fix yet | — |
| Ubuntu 24.04 LTS | node-loader-utils | No fix yet | — |
| Ubuntu 22.04 LTS | node-loader-utils | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-loader-utils | No fix yet | — |
| Ubuntu 18.04 LTS | node-loader-utils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | grafana | 9.2.10-7.el9_3 | RHSA-2023:6420 |
| RHEL 8 | grafana | 9.2.10-7.el8_9 | RHSA-2023:6972 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | reaper | 3.1.1-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu | 2.11.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | loader-utils | >= 2.0.0, < 2.0.3 | 2.0.3 | GHSA-76p3-8jx3-jpfq |
| npm | loader-utils | < 1.4.1 | 1.4.1 | GHSA-76p3-8jx3-jpfq |
Advisories 11
- RHSA-2023:6420 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:6972 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- DLA-3258-1 node-loader-utils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2024-0049 Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0157 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
- WID-SEC-2024-1696 SolarWinds Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
References
- https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11
- https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47
- https://github.com/webpack/loader-utils/issues/212
- https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884
- https://dl.acm.org/doi/abs/10.1145/3488932.3497769
- https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
- http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
- [debian-lts-announce] 20221231 [SECURITY] [DLA 3258-1] node-loader-utils security update mailing-list