webpack
NPM Package
Vulnerability Check
Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.
webpack
Advisory Breakdown
Severity Rating
Critical4 advisories
Critical
Weekly downloads
49,111,709
Total advisories
4
Latest version
5.107.2
License
MIT
Known advisories
OSV records for the npm ecosystem
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Cross-realm object access in Webpack 5
Checked Jun 12, 2026, 4:48 PM from npm and OSV.dev
Package metadata
From the npm registry
- Package name
- webpack
- Ecosystem
- npm
- Latest version
- 5.107.2
- License
- MIT
- Weekly downloads
- 49,111,709
- Repository
- Open repository
Remediation boundary
What RequestGuard does — and doesn't — cover
RequestGuard does not fix npm package vulnerabilities. Dependency remediation happens through package updates, patches, lockfile changes, and maintainer guidance. RequestGuard can help mitigate runtime abuse around exposed web and API flows while remediation is handled separately.
Data from npm registry and OSV.dev · Checked 6/12/2026, 4:48:37 PM