webpack vulnerabilities and fixes

Recent CVEs affecting webpack, with upgrade or downgrade steps. 3 tracked.

webpack has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-02-05. Highest priority: CVE-2024-43788 (score 43/100).

• CVE-2025-68458 LOW 3.7 UPGRADE Webpack is a module bundler
• CVE-2025-68157 LOW 3.7 UPGRADE Webpack is a module bundler
• CVE-2024-43788 MEDIUM 6.4 UPGRADE Webpack is a module bundler

FAQ

How do I fix webpack vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is webpack being exploited right now?

None of the tracked webpack CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which webpack CVE should I patch first?

CVE-2024-43788 currently ranks highest (43/100): Webpack is a module bundler.

RSS feed for webpack · ← Back to latest CVEs