CVE-2025-68458: webpack Policy Bypass Leading to SSRF Vulnerability
Summary
CVE-2025-68458: When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). Affects webpack versions >= 5.49.0, < 5.104.1. Fixed in 5.104.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webpack is a popular open-source JavaScript module bundler that allows developers to bundle their JavaScript applications efficiently. It supports various features such as code splitting, lazy loading, and asset management, making it a crucial tool in modern web development. However, when the 'experiments.buildHttp' feature is enabled, it becomes susceptible to a significant vulnerability that can lead to unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from a flaw in the 'allowedUris' validation mechanism within webpack's HTTP(S) resolver, specifically the HttpUriPlugin. When 'experiments.buildHttp' is enabled, crafted URLs containing userinfo (username:password@host) can bypass the allow-list check. This allows attackers to fetch resources from unauthorized hosts, leading to potential Server-Side Request Forgery (SSRF) attacks and untrusted content inclusion in build outputs. The root cause is that the validation relies on a raw string prefix check, which can be easily manipulated by attackers to exploit the system.
How To Fix
Latest published version: 5.112.0 as of 22 Oct 2026
npm install webpack@5.112.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.104.1
This is the first release that contains the fix.
npm install webpack@5.104.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid enabling the 'experiments.buildHttp' feature until you can update to the patched version. Additionally, ensure that your 'allowedUris' validation mechanism is robust and does not rely solely on raw string checks.
Conclusion
In summary, CVE-2025-68458 is a critical vulnerability in webpack that can lead to SSRF attacks due to improper validation of allowed URIs. It is essential to update to the latest version of webpack to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for webpack →
FAQ
CVE-2025-68458 is a vulnerability in webpack that allows for a policy bypass leading to Server-Side Request Forgery (SSRF) behavior.
If exploited, this vulnerability can allow attackers to make unauthorized requests to internal services, potentially leading to data leaks or other security issues.
webpack versions up to and including 5.104.0 are affected by this vulnerability.
You can use Vulert, which monitors your package-lock.json for vulnerabilities. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack.
