Webpack.js - vulnerabilities (CVEs)

15 CVEs in 4 products, 0 in the last 30 days, newest from 2026-07-03.

Products

• Webpack-dev-server - 7 CVEs
• Webpack - 4 CVEs
• Loader-utils - 3 CVEs
• Webpack-dev-middleware - 1 CVEs

Newest CVEs of Webpack.js

• CVE-2026-14631 - CVSS 5.3 (medium), 2026-07-03: webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a…
• CVE-2026-14620 - CVSS 4.7 (medium), 2026-07-03: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate,…
• CVE-2026-9595 - CVSS 5.3 (medium), 2026-06-15: Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket…
• CVE-2026-6402 - CVSS 6.5 (medium), 2026-05-12: webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy…
• CVE-2025-68157 - CVSS 3.7 (low), 2026-02-05: Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces…
• CVE-2025-68458 - CVSS 3.7 (low), 2026-02-05: Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be…
• CVE-2025-30360 - CVSS 6.5 (medium), 2025-06-03: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users'…
• CVE-2025-30359 - CVSS 5.9 (medium), 2025-06-03: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users'…
• CVE-2024-43788 - CVSS 6.4 (medium), 2024-08-27: Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or…
• CVE-2024-29180 - CVSS 7.5 (high), 2024-03-21: Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address…
• CVE-2023-28154 - CVSS 9.8 (critical), 2023-03-13: Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a…
• CVE-2022-37603 - CVSS 7.5 (high), 2022-10-14: A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url…
• CVE-2022-37601 - CVSS 9.8 (critical), 2022-10-12: Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all…
• CVE-2022-37599 - CVSS 7.5 (high), 2022-10-11: A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the…
• CVE-2018-14732 - CVSS 7.5 (high), 2018-09-21: An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is…