webpack vulnerabilities (npm)

4 vulnerabilities.

• webpack npm webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-68458 Fix available 3.7 LowFebruary 5, 2026
• webpack npm webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVE-2025-68157 Fix available 3.7 LowFebruary 5, 2026
• webpack npm DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) CVE-2024-43788 Public exploitFix available 6.4 MediumAugust 27, 2024
• webpack npm Cross-realm object access in Webpack 5 CVE-2023-28154 Fix available 9.8 CriticalMarch 13, 2023