Skip to main content
cve.nowby Sazabi
← npm
npmPackage

webpack

4 known vulnerabilities (1 critical, 1 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 1 medium, 2 low
Registry
npm

Advisories 4

  • webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

    Affected: from 5.49.0, fixed in 5.104.0.

  • webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

    Affected: from 5.49.0, fixed in 5.104.1.

  • CVE-2024-43788Medium 6.4

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    Affected: from 5.0.0-alpha.0, fixed in 5.94.0.

  • CVE-2023-28154Critical 9.8

    Webpack 5 before 5.76.0 does not avoid cross-realm object access.

    Affected: from 5.0.0, fixed in 5.76.0.