Skip to content
OpenAdvisories

Package · Debian

node-webpack

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 3.7
    CVE-2025-68157

    webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

    Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x …

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • Low 3.7
    CVE-2025-68458

    webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

    Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo…

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • Medium 6.4
    CVE-2024-43788 Public exploit

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulner…

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • Critical 9.8
    CVE-2023-28154

    Cross-realm object access in Webpack 5

    Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

    node-webpack webpack node-webpack Debian Ubuntu npm