Webpack.js vulnerabilities
We track 4 vulnerabilities in Webpack.js products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 21, 2024.
Latest Webpack.js vulnerabilities
- 7.5 High severity
webpack-dev-middleware: Improper Limitation of a Pathname to a Restricted Directory
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The
- 7.5 High severity
Loader-utils: Inefficient Regular Expression Complexity
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- 9.8 Critical severity
Loader-utils: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
- 7.5 High severity
Loader-utils: Inefficient Regular Expression Complexity
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.