3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68157

CVE-2025-68157: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68157

CVE-2025-68157:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webpack	npm	>= 5.49.0, < 5.104.0	5.104.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) located in webpack's HttpUriPlugin, which is activated when experiments.buildHttp is enabled. The root cause is the failure to re-validate URLs against the allowedUris configuration after an HTTP 3xx redirect. The initial resource URL is correctly checked, but if it redirects, the new URL specified in the Location header is trusted and fetched without a security check. This allows an attacker to use an allowed domain as an open redirect to access internal or otherwise restricted network resources from the build server. The provided patch rectifies this by introducing validation logic within the redirect handling code. Specifically, a new validateRedirectLocation function is added and called from within the fetch and resolveContent closures inside HttpUriPlugin.apply. This ensures that any redirected URL is checked against the allowedUris policy, is a valid http(s) URL, and does not exceed a new maximum redirect limit, effectively closing the SSRF loophole.

Vulnerable functions

HttpUriPlugin.apply

lib/schemes/HttpUriPlugin.js

The `apply` method in `HttpUriPlugin` sets up the logic for fetching resources over HTTP/S. It defines closures, including `fetch` and `resolveContent`, to handle requests and redirects. The vulnerability existed within these closures. When an HTTP 3xx redirect was encountered, the new URL from the `Location` header was followed without being re-validated against the `allowedUris` list. This allowed a malicious actor to craft a redirect from an allowed URI to a forbidden one, leading to a Server-Side Request Forgery (SSRF).

HttpUriPlugin.apply.resolveContent

lib/schemes/HttpUriPlugin.js

This closure within `HttpUriPlugin.apply` is responsible for recursively following HTTP redirects. The vulnerability is that it would call itself with the unvalidated `result.location` (the URL from the redirect's `Location` header). This lack of validation allowed the `allowedUris` policy to be bypassed.

HttpUriPlugin.apply.fetch

lib/schemes/HttpUriPlugin.js

This closure within `HttpUriPlugin.apply` handles the low-level HTTP request. Upon receiving a 3xx redirect response, it would construct a new URL from the `Location` header and pass it to the `resolveContent` function for processing. This new URL was not validated against the `allowedUris` list, initiating the SSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.