Improper Neutralization The advisory has been revoked - it doesn't affect any version of package nodejs-webpack (opens in a new tab)

Threat Intelligence

0.68% (51^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL10-NODEJSWEBPACK-17274393
published10 Jun 2026
disclosed5 May 2026

Report a new vulnerability Found a mistake?

Introduced: 5 May 2026

CVE-2026-6322 (opens in a new tab) CWE-140 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-webpack package and not the nodejs-webpack package as distributed by RHEL.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.