CVE-2022-37601: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Affected products

• Debian Debian Linux: version 10.0 only
• Webpack.js Loader-Utils: before 1.4.1 (fixed in 1.4.1); from 2.0.0, before 2.0.3 (fixed in 2.0.3)

Published 2022-10-12. Last modified 2026-06-17.