CVE-2025-68157

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.

• CWE-918

• https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758Exploit, Vendor Advisory

Published

Feb 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68151CoreDNS is a DNS server that chains plugins. Prior to versio…7.5
• CVE-2025-68152Juju is an open source application orchestration engine that…4.9
• CVE-2025-68153Juju is an open source application orchestration engine that…6.5
• CVE-2025-68154systeminformation is a System and OS information library for…8.1
• CVE-2025-68155@vitejs/plugin-rs provides React Server Components (RSC) sup…7.5
• CVE-2025-68156Expr is an expression language and expression evaluation for…7.5
• CVE-2025-68158Authlib is a Python library which builds OAuth and OpenID Co…8.8
• CVE-2025-6816A vulnerability classified as problematic was found in HDF5 …3.3
• CVE-2025-68160Issue summary: Writing large, newline-free data into a BIO c…4.7
• CVE-2025-68161The Socket Appender in Apache Log4j Core versions 2.0-beta9 …4.8
• CVE-2025-68162In JetBrains TeamCity before 2025.11 maven embedder allowed …2.7
• CVE-2025-68163In JetBrains TeamCity before 2025.11 stored XSS was possible…4.8