CVE-2025-68157
HTTP Redirect Bypass in Webpack Causes SSRF and Code Injection
Publication date: 2026-02-05
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webpack.js | webpack | From 5.49.0 (inc) to 5.104.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Webpack versions from 5.49.0 to before 5.104.0 when the experiments.buildHttp feature is enabled. The issue is that Webpack's HTTP(S) resolver, called HttpUriPlugin, only enforces allowedUris restrictions on the initial URL requested. However, if the initial URL responds with an HTTP 30x redirect, the redirected URL is not re-validated against the allowedUris list.
As a result, an import that should be restricted to a trusted allow-list can be redirected to URLs outside that allow-list. This bypasses the intended policy or allow-list restrictions, enabling build-time Server-Side Request Forgery (SSRF) behavior where the build machine may make requests to internal-only endpoints depending on network access. Additionally, untrusted content from these redirected URLs can be included in the build output as module source code.
This vulnerability was fixed in Webpack version 5.104.0.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to bypass the intended URL allow-list restrictions during the build process. This means that untrusted or malicious content from external or internal URLs could be included in your build outputs.
Additionally, it enables build-time Server-Side Request Forgery (SSRF), where the build machine might be tricked into making HTTP requests to internal-only endpoints that are normally inaccessible, potentially exposing sensitive internal services or data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade webpack to version 5.104.0 or later, where the issue has been patched.