Webpack.js vulnerabilities

Products

• Webpack-dev-server 9
• Webpack 4
• Loader-utils 3

Newest

• webpack-dev-server webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint CVE-2026-114348 5.3 MediumOctober 22, 2026
• webpack-dev-server webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades CVE-2026-112085 Fix available 8.2 HighOctober 22, 2026
• webpack-dev-server webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVE-2026-14631 Fix available 5.3 MediumJuly 3, 2026
• webpack-dev-server webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints CVE-2026-14620 Public exploitFix available 4.7 MediumJuly 3, 2026
• webpack-dev-server webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies CVE-2026-9595 Fix available 5.3 MediumJune 15, 2026
• webpack-dev-server webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins CVE-2026-6402 Fix available 5.3 MediumMay 12, 2026
• webpack webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-68458 Fix available 3.7 LowFebruary 5, 2026
• webpack webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVE-2025-68157 Fix available 3.7 LowFebruary 5, 2026
• webpack webpack-dev-server webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser CVE-2025-30360 Fix available 6.5 MediumJune 3, 2025
• webpack webpack-dev-server webpack-dev-server users' source code may be stolen when they access a malicious web site CVE-2025-30359 Fix available 5.3 MediumJune 3, 2025
• webpack DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) CVE-2024-43788 Public exploitFix available 6.4 MediumAugust 27, 2024
• webpack webpack-dev-middleware webpack-dev-middleware Path Traversal vulnerability CVE-2024-29180 Fix available 7.4 HighMarch 21, 2024
• webpack.js webpack Cross-realm object access in Webpack 5 CVE-2023-28154 Fix available 9.8 CriticalMarch 13, 2023
• webpack.js loader-utils loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable CVE-2022-37603 Fix available 7.5 HighOctober 14, 2022
• webpack.js loader-utils, debian linux +1 more Prototype pollution in webpack loader-utils CVE-2022-37601 Fix available 9.8 CriticalOctober 12, 2022
• webpack.js loader-utils loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2022-37599 Fix available 7.5 HighOctober 11, 2022
• webpack.js webpack-dev-server Missing Origin Validation in webpack-dev-server CVE-2018-14732 Fix available 7.5 HighSeptember 21, 2018