Skip to content
OpenAdvisories

Package · Ubuntu

node-webpack

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-114348

    webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

    webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for brow…

    webpack-dev-server webpack-dev-server node-webpack Ubuntu
  • Medium 5.3
    CVE-2026-9595

    webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend,…

    webpack-dev-server webpack-dev-server webpack-dev-server node-webpack Ubuntu npm
  • Medium 6.4
    CVE-2024-43788 Public exploit

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulner…

    webpack webpack node-webpack webpack Debian Ubuntu npm