webpack
npmlatest 5.112.2 · 2026-10-23www.npmjs.com · all 892 versions
Security advisories3
- webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistencefixed in 5.104.0
- webpack: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSSfixed in 5.94.0
- webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorfixed in 5.104.1
Versions that change something
- 5.94.02024-08fixes 1 advisory
- 5.104.02025-12fixes 1 advisory
- 5.104.12025-12fixes 1 advisory