CVE-2025-68458: SSRF in webpack 5.104.1

The SSRF vulnerability in webpack arises when the experiments.buildHttp feature is enabled and the allowedUris configuration is improperly validated. Attackers can craft URLs containing userinfo (username:password@host) that bypass the intended prefix-based validation. This bypass occurs because the URL parsing process resolves the hostname after the initial validation, effectively allowing requests to arbitrary external hosts. This can expose sensitive internal resources, allow attackers to interact with internal services, or potentially be used for reconnaissance purposes. The impact is primarily limited to the build environment, but could lead to data exfiltration or compromise of build dependencies if the build process has access to sensitive information.

1. Reserved2025-12-17
2. Published2026-02-05
3. Modified2026-02-14
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68458 is to upgrade to webpack version 5.104.1 or later. If upgrading is not immediately feasible, consider disabling the experiments.buildHttp feature entirely, as this eliminates the vulnerability. As a temporary workaround, ensure that the allowedUris configuration strictly enforces full URL matching, rather than relying on simple prefix checks. Implement network segmentation to restrict outbound traffic from the build environment. Monitor build logs for suspicious outbound requests. After upgrading, confirm the fix by attempting to craft a malicious URL with userinfo and verifying that it is blocked by the allowedUris restriction.

Last updated

5.107.1recently