Webpack vulnerabilities
We track 2 vulnerabilities in Webpack products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 24, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Webpack vulnerabilities
- 7.4 High severity
webpack-dev-middleware: Improper Limitation of a Pathname to a Restricted Directory
webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string pre
- 7.5 High severity
webpack-dev-middleware: Improper Limitation of a Pathname to a Restricted Directory
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The