1955 matches found
Malicious Package
Overview epic-webpack-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview epic-webpack-hot-dev-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview epic-webpack-node-externals is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...
CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...
EUVD-2026-64850
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)
webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: OSV:GHSA-G84C-RXFJ-3J2C...
@angular-architects/native-federation (>=20.3.1, <=21.2.6), @angular-architects/native-federation-v4 (>=20.3.0, <=21.2.15) +112 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)
webpack-dev-middleware NPM version =7.0.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =1.0.0, =6.0.0, =21.2.2-depup.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =6.0.0-edsv2-beta-3 and more Source cves: CVE-2026-76844 Source advisory:...
GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
CLEANSTART-2026-YT66630 webpack-dev-server allows users to use webpack with a development server that provides live reloading
Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...
CLSA-2026-1790604947 TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1...
CLSA-2026-1790604916 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.4-tuxcare.1...
CLSA-2026-1790520250 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...
PT-2026-107633
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...
Malicious Package
Overview epic-react-webpack-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...
webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal
A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...