FKIE_CVE-2025-68157

Vulnerability from fkie_nvd - Published: 2026-02-05 23:15 - Updated: 2026-02-13 19:21
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Summary
Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.
References
security-advisories@github.comhttps://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758Exploit, Vendor Advisory
Impacted products
Vendor Product Version
webpack.js webpack *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "ADA354B0-6A76-4EF0-B94E-51DA67B927C1",
              "versionEndExcluding": "5.104.0",
              "versionStartIncluding": "5.49.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0."
    },
    {
      "lang": "es",
      "value": "Webpack es un empaquetador de m\u00f3dulos. Desde la versi\u00f3n 5.49.0 hasta antes de la 5.104.0, cuando experiments.buildHttp est\u00e1 habilitado, el resolvedor HTTP(S) de webpack (HttpUriPlugin) aplica allowedUris solo para la URL inicial, pero no vuelve a validar allowedUris despu\u00e9s de seguir redirecciones HTTP 30x. Como resultado, una importaci\u00f3n que parece restringida a una lista de permitidos de confianza puede ser redirigida a URLs HTTP(S) fuera de la lista de permitidos. Esto es una omisi\u00f3n de pol\u00edtica/lista de permitidos que habilita el comportamiento SSRF en tiempo de compilaci\u00f3n (solicitudes desde la m\u00e1quina de compilaci\u00f3n a puntos finales solo internos, dependiendo del acceso a la red) y la inclusi\u00f3n de contenido no confiable en las salidas de compilaci\u00f3n (el contenido redirigido se trata como fuente de m\u00f3dulo y se empaqueta). Este problema ha sido parcheado en la versi\u00f3n 5.104.0."
    }
  ],
  "id": "CVE-2025-68157",
  "lastModified": "2026-02-13T19:21:27.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-05T23:15:53.777",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.