node-webpack vulnerabilities (Debian)

4 vulnerabilities.

• node-webpack Debian webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-68458 Fix available 3.7 LowFebruary 5, 2026
• node-webpack Debian webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVE-2025-68157 Fix available 3.7 LowFebruary 5, 2026
• node-webpack Debian DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) CVE-2024-43788 Public exploitFix available 6.4 MediumAugust 27, 2024
• node-webpack Debian Cross-realm object access in Webpack 5 CVE-2023-28154 Fix available 9.8 CriticalMarch 13, 2023