webpack vulnerabilities (TuxCare)

3 vulnerabilities.

• webpack TuxCare webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-68458 Fix available 3.7 LowFebruary 5, 2026
• webpack TuxCare webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVE-2025-68157 Fix available 3.7 LowFebruary 5, 2026
• webpack TuxCare DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) CVE-2024-43788 Public exploitFix available 6.4 MediumAugust 27, 2024