webpack.js records
15 published records for vendor webpack.js.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-1333 Inefficient Regular Expression Complexity2
- CWE-20 Improper Input Validation2
- CWE-346 Origin Validation Error2
- CWE-749 Exposed Dangerous Method or Function2
- CWE-352 Cross-Site Request Forgery (CSRF)1
The weakness classes this vendor ships most often: where to look.
CWEAll records
15 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2022-37601No exploit | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.webpack.js · loader-utils · CWE-1321 | Critical9.8 | — | 2.9% | Oct 12, 2022 |
39Monitor | CVE-2023-28154No exploit | Webpack 5 before 5.76.0 does not avoid cross-realm object access.webpack.js · webpack | Critical9.8 | — | 1.4% | Mar 12, 2023 |
31Monitor | CVE-2018-14732No exploit | An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.webpack.js · webpack-dev-server · CWE-20 | High7.5 | — | 2.6% | Sep 21, 2018 |
31Monitor | CVE-2022-37599No exploit | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.webpack.js · loader-utils · CWE-1333 | High7.5 | — | 2.2% | Oct 11, 2022 |
31Monitor | CVE-2022-37603No exploit | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.webpack.js · loader-utils · CWE-1333 | High7.5 | — | 2.2% | Oct 14, 2022 |
30Monitor | CVE-2024-29180No exploit | webpack-dev-middleware Path Traversal vulnerabilitywebpack.js · webpack-dev-middleware · CWE-22 | High7.5 | — | 1.2% | Mar 21, 2024 |
26Monitor | CVE-2026-6402No exploit | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originswebpack.js · webpack-dev-server · CWE-749 | Medium6.5 | — | 0.4% | May 12, 2026 |
26Monitor | CVE-2025-30360No exploit | webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserwebpack.js · webpack-dev-server · CWE-346 | Medium6.5 | — | 0.3% | Jun 3, 2025 |
24Monitor | CVE-2024-43788Proof of concept | DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)webpack.js · webpack · CWE-79 | Medium6.1 | — | 1.0% | Aug 27, 2024 |
23Monitor | CVE-2025-30359No exploit | webpack-dev-server users' source code may be stolen when they access a malicious web sitewebpack.js · webpack-dev-server · CWE-749 | Medium5.9 | — | 0.6% | Jun 3, 2025 |
21Monitor | CVE-2026-14631No exploit | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerwebpack.js · webpack-dev-server · CWE-20 | Medium5.3 | — | 0.5% | Jul 3, 2026 |
18Monitor | CVE-2026-14620Proof of concept | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointswebpack.js · webpack-dev-server · CWE-352 | Medium4.7 | — | 0.5% | Jul 3, 2026 |
17Monitor | CVE-2026-9595No exploit | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxieswebpack.js · webpack-dev-server · CWE-346 | Medium4.3 | — | 0.2% | Jun 15, 2026 |
14Monitor | CVE-2025-68458No exploit | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorwebpack.js · webpack · CWE-918 | Low3.7 | — | 0.2% | Feb 5, 2026 |
14Monitor | CVE-2025-68157No exploit | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirectswebpack.js · webpack · CWE-918 | Low3.7 | — | 0.2% | Feb 5, 2026 |
- CVE-2022-3760140Plan
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.
CriticalCVSS 9.8No exploitEPSS 3%webpack.js · loader-utilsOct 12, 2022
- CVE-2023-2815439Monitor
Webpack 5 before 5.76.0 does not avoid cross-realm object access.
CriticalCVSS 9.8No exploitEPSS 1%webpack.js · webpackMar 12, 2023
- CVE-2018-1473231Monitor
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.
HighCVSS 7.5No exploitEPSS 3%webpack.js · webpack-dev-serverSep 21, 2018
- CVE-2022-3759931Monitor
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.
HighCVSS 7.5No exploitEPSS 2%webpack.js · loader-utilsOct 11, 2022
- CVE-2022-3760331Monitor
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.
HighCVSS 7.5No exploitEPSS 2%webpack.js · loader-utilsOct 14, 2022
- CVE-2024-2918030Monitor
webpack-dev-middleware Path Traversal vulnerability
HighCVSS 7.5No exploitEPSS 1%webpack.js · webpack-dev-middlewareMar 21, 2024
- CVE-2026-640226Monitor
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
MediumCVSS 6.5No exploitEPSS 0%webpack.js · webpack-dev-serverMay 12, 2026
- CVE-2025-3036026Monitor
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
MediumCVSS 6.5No exploitEPSS 0%webpack.js · webpack-dev-serverJun 3, 2025
- CVE-2024-4378824Monitor
DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
MediumCVSS 6.1Proof of conceptEPSS 1%webpack.js · webpackAug 27, 2024
- CVE-2025-3035923Monitor
webpack-dev-server users' source code may be stolen when they access a malicious web site
MediumCVSS 5.9No exploitEPSS 1%webpack.js · webpack-dev-serverJun 3, 2025
- CVE-2026-1463121Monitor
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
MediumCVSS 5.3No exploitEPSS 1%webpack.js · webpack-dev-serverJul 3, 2026
- CVE-2026-1462018Monitor
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
MediumCVSS 4.7Proof of conceptEPSS 1%webpack.js · webpack-dev-serverJul 3, 2026
- CVE-2026-959517Monitor
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
MediumCVSS 4.3No exploitEPSS 0%webpack.js · webpack-dev-serverJun 15, 2026
- CVE-2025-6845814Monitor
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
LowCVSS 3.7No exploitEPSS 0%webpack.js · webpackFeb 5, 2026
- CVE-2025-6815714Monitor
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
LowCVSS 3.7No exploitEPSS 0%webpack.js · webpackFeb 5, 2026