CVE-2025-68157 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that...

CVE-2025-68157

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that...

CVE-2025-68157

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that...

CVE-2025-68157

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that...

CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458

Webpack CVE-2025-68458 affects Webpack’s HTTP(S) resolver (HttpUriPlugin) when experiments.buildHttp is enabled. A crafted URL containing userinfo (username:password@host) can bypass allowedUris checks and cause the build process to request resources from internal or non-whitelisted hosts, enabli...

EUVD-2025-206877

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris enforcement relies on a raw string prefix check e.g.,...

GHSA-8FGC-7CC6-RX7X webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris enforcement relies on a raw string prefix check e.g.,...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2556 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: OSV:GHSA-8FGC-7CC6-RX7X...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2556 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: SNYK:JS-WEBPACK-15235959...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HttpUriPlugin component. An attacker can cause unauthorized outbound requests to internal or otherwise restricted endpoints and include untrusted content in build outputs by crafting URLs with...

webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2556 more potentially affected by CVE-2025-68157 via webpack (>=5.49.0, <=5.103.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68157 Source advisory: SNYK:JS-WEBPACK-15235969...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2556 more potentially affected by CVE-2025-68157 via webpack (>=5.49.0, <=5.103.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68157 Source advisory: OSV:GHSA-38R7-794H-5758...