CVE-2025-68157: webpack Policy Bypass via HTTP Redirects Leading to SSRF
Summary
CVE-2025-68157: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence. Affects webpack versions >= 5.49.0, < 5.104.0. Fixed in 5.104.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webpack is a widely-used module bundler for JavaScript applications, allowing developers to compile and bundle their code efficiently. It supports various features such as code splitting, lazy loading, and asset management. However, when the 'experiments.buildHttp' feature is enabled, it introduces a vulnerability that can be exploited through improper handling of HTTP redirects, potentially leading to server-side request forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from the fact that when 'experiments.buildHttp' is enabled, webpack's HTTP(S) resolver (HttpUriPlugin) only checks the 'allowedUris' for the initial URL request. It fails to re-validate these allowed URIs after following HTTP 30x redirects. This oversight allows an attacker to redirect requests to unauthorized HTTP(S) URLs, which can lead to SSRF behavior, enabling the build machine to make requests to internal services. Additionally, untrusted content from these redirects can be included in the build outputs, posing a significant security risk.
How To Fix
Latest published version: 5.112.0 as of 22 Oct 2026
npm install webpack@5.112.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.104.0
This is the first release that contains the fix.
npm install webpack@5.104.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'experiments.buildHttp' feature in your webpack configuration until you can update to a patched version. This can be done by removing or commenting out the 'experiments' section in your webpack configuration file.
Conclusion
The vulnerability CVE-2025-68157 in webpack poses a significant risk due to improper handling of HTTP redirects, allowing for SSRF attacks and untrusted content inclusion. It is crucial for developers to update to the patched version to mitigate these risks effectively.
See every vulnerability recorded for webpack →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include unauthorized access to internal services through SSRF, inclusion of untrusted content in build outputs, and potential execution of attacker-controlled JavaScript.
Yes, you can disable the 'experiments.buildHttp' feature in your webpack configuration as a temporary measure until you can update.
Versions of webpack prior to 5.104.0 are affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack.
