Priority HIGH 82
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03503 · Published 2022-10-12 · Partial fix · 2.0.3, 1.4.1 CWE-1321
Priority HIGH 66
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01226 · Published 2024-03-21 · Partial fix · 7.1.0, 6.1.2 +1 CWE-22
Priority MEDIUM 62
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00357 · Published 2025-06-03 · Partial fix · 5.2.1 CWE-346
Priority MEDIUM 62
Webpack is a module bundler.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00959 · Published 2024-08-27 · Partial fix · 5.94.0 CWE-79
Priority MEDIUM 60
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00598 · Published 2025-06-03 · Partial fix · 5.2.1 CWE-749
Priority MEDIUM 52
Webpack 5 before 5.76.0 does not avoid cross-realm object access.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01409 · Published 2023-03-13 · Partial fix · 5.76.0
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.1 CWE-918
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.0 CWE-918
Priority MEDIUM 44
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02702 · Published 2022-10-14 · Partial fix · 1.4.2, 2.0.4 +1 CWE-1333
Priority LOW 38
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02761 · Published 2022-10-11 · Partial fix · 1.4.2, 2.0.4 +1 CWE-1333
Priority LOW 38
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02486 · Published 2018-09-21 · Fixed in 3.1.11 CWE-20
Priority LOW 35
webpack-dev-server is a development server that provides live reloading for webpack projects.
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00147 · Published 2026-10-22 · Fixed in 5.2.7, 6.1.0 CWE-1385
Priority LOW 31
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws end…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00517 · Published 2026-07-03 · Fixed in 5.2.6 CWE-20
Priority LOW 30
webpack-dev-server is a development server that provides live reloading for webpack projects.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00305 · Published 2026-10-22 · Fixed in 5.2.7, 6.1.0 CWE-1289
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-06-15 · Partial fix · 5.2.5 CWE-346
Priority LOW 29
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00291 · Published 2026-05-12 · Partial fix · 5.2.4 CWE-749
Priority LOW 22
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without ve…
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00521 · Published 2026-07-03 · Partial fix · 5.2.6 CWE-352
THREATIST.IORead the docs