Skip to content
OpenAdvisories

Vendor

webpack

6 known vulnerabilities.

webpack at a glance

Last 12 months
2
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 2 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202620
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202520
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

webpack 3 webpack-dev-server 2 webpack-dev-middleware 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Low 3.7
    CVE-2025-68157

    webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

    Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x …

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • Low 3.7
    CVE-2025-68458

    webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

    Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo…

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • Medium 6.5
    CVE-2025-30360

    webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origi…

    webpack webpack-dev-server webpack-dev-server npm
  • Medium 5.3
    CVE-2025-30359

    webpack-dev-server users' source code may be stolen when they access a malicious web site

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by…

    webpack webpack-dev-server webpack-dev-server npm
  • Medium 6.4
    CVE-2024-43788 Public exploit

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulner…

    webpack webpack node-webpack webpack Debian Ubuntu npm
  • High 7.4
    CVE-2024-29180

    webpack-dev-middleware Path Traversal vulnerability

    Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The…

    webpack webpack-dev-middleware webpack-dev-middleware npm