package

npm/webpack

pkg:npm/webpack

LOW3.7npm

webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

Modified: 9/10/2026

MEDIUM6.4npm

Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

Modified: 9/10/2026

LOW3.7npm

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Modified: 9/10/2026

CRITICAL9.8npm

Cross-realm object access in Webpack 5

Modified: 11/8/2023