npm package
webpack vulnerabilities by version
The latest release, 5.112.0 (Oct 15, 2026), has no known vulnerabilities. 25% of last week’s 56.2M downloads went to versions with known vulnerabilities. OSV.dev lists 4 advisories for webpack; the newest was published on Feb 5, 2026.
npm (opens in a new tab) describes it as “Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es…”
- Latest release
- 5.112.0
- Oct 15, 2026, no known vulnerabilities
- Downloads last week
- 56.2M
- All versions, from npm
- Advisories on OSV.dev
- 4
- Newest Feb 5, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable webpack
25% of last week’s 56.2M webpack downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. webpack doesn’t publish support dates we can check.
Newest advisories
The 4 most recently published, with the versions each one affects.
LowCVE-2025-68458 on OSV.dev (opens in a new tab)GHSA-8fgc-7cc6-rx7x
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Affects >= 5.49.0, < 5.104.1. Published Feb 5, 2026.
LowCVE-2025-68157 on OSV.dev (opens in a new tab)GHSA-38r7-794h-5758
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Affects >= 5.49.0, < 5.104.0. Published Feb 5, 2026.
WarningCVE-2024-43788 on OSV.dev (opens in a new tab)GHSA-4vvj-4cpr-p986
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
Affects >= 5.0.0-alpha.0, < 5.94.0. Published Aug 27, 2024.
CriticalCVE-2023-28154 on OSV.dev (opens in a new tab)GHSA-hc6q-2mpp-qw7j
Cross-realm object access in Webpack 5
Affects >= 5.0.0, < 5.76.0. Published Mar 13, 2023.
Which webpack do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for webpack, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.