<p dir="auto"><strong>Do you want to request a <em>feature</em> or report a <em>bug</em>?</strong><br>
Bug</p>


<p dir="auto"><strong>What is the current behavior?</strong><br>
Two identical sub-dependencies are being included twice in the build.</p>
<p dir="auto"><strong>If the current behavior is a bug, please provide the steps to reproduce.</strong><br>
<code class="notranslate">projectA</code> depends on <code class="notranslate">libA@^2.0.0</code>, <code class="notranslate">depA</code> and <code class="notranslate">depB</code>.<br>
<code class="notranslate">depA</code> and <code class="notranslate">depB</code> both depend on <code class="notranslate">libA@^1.0.0</code></p>
<p dir="auto">This results in a directory structure like this:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="projectA
- node_modules
-- libA
-- depA
---- node_modules/libA
-- depB
---- node_modules/libA "><pre class="notranslate"><code class="notranslate">projectA
- node_modules
-- libA
-- depA
---- node_modules/libA
-- depB
---- node_modules/libA 
</code></pre></div>
<p dir="auto">When the project is built, included in the bundle are:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="libA@2.0.0
depA
depB
libA@1.0.0
libA@1.0.0"><pre class="notranslate"><code class="notranslate">libA@2.0.0
depA
depB
libA@1.0.0
libA@1.0.0
</code></pre></div>



<p dir="auto"><strong>What is the expected behavior?</strong><br>
The included modules should be:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="libA@2.0.0
depA
depB
libA@1.0.0"><pre class="notranslate"><code class="notranslate">libA@2.0.0
depA
depB
libA@1.0.0
</code></pre></div>
<p dir="auto"><strong>Please mention other relevant information such as the browser version, Node.js version, webpack version and Operating System.</strong><br>
<code class="notranslate">webpack@3.5.5</code></p>
<p dir="auto">I have run <code class="notranslate">npm dedupe</code> but it can't fix the problem. This is understandable, because npm doesn't have anywhere to "put" this lower-version dependency that is shared by both <code class="notranslate">depA</code> and <code class="notranslate">depB</code>. Previously I believe this was solved with the <code class="notranslate">DedupePlugin</code> which has since been turned into a no-op.</p>
<h1 dir="auto">Bug report</h1>




<p dir="auto"><strong>What is the current behavior?</strong><br>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-27290" rel="nofollow">CVE-2021-27290</a></p>
<blockquote>
<p dir="auto">ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.</p>
</blockquote>
<p dir="auto">The fix is to bump <code class="notranslate">ssri</code> to <code class="notranslate">8.0.1</code>.</p>
<p dir="auto">The dependency path to <code class="notranslate">ssri</code> is <code class="notranslate">webpack</code> &gt; <code class="notranslate">terser-webpack-plugin</code> &gt; <code class="notranslate">cacache</code> &gt; <code class="notranslate">ssri</code></p>
<p dir="auto">I've reported this issue in <code class="notranslate">terser-webpack-plugin</code> at <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="834799392" data-permission-text="Title is private" data-url="https://github.com/webpack-contrib/terser-webpack-plugin/issues/388" data-hovercard-type="issue" data-hovercard-url="/webpack-contrib/terser-webpack-plugin/issues/388/hovercard" href="https://github.com/webpack-contrib/terser-webpack-plugin/issues/388">webpack-contrib/terser-webpack-plugin#388</a></p>
<p dir="auto"><strong>If the current behavior is a bug, please provide the steps to reproduce.</strong></p>






<p dir="auto"><strong>What is the expected behavior?</strong><br>
There shouldn't be any CVE's found when evaluating Webpack :)</p>


<p dir="auto"><strong>Other relevant information:</strong><br>
webpack version:  <code class="notranslate">4.46.0</code><br>
Node.js version: all<br>
Operating System: all</p>