Policy Bypass in Webpack Affects Multiple Versions
CVE-2025-68157

3.7LOW

Key Information:

Vendor

Webpack

Status
Webpack
Vendor
CVE Published:
5 February 2026

What is CVE-2025-68157?

In Webpack versions from 5.49.0 to just before 5.104.0, a critical vulnerability exists where the HTTP(S) resolver fails to revalidate allowed URIs post-30x redirects. This failure potentially allows an attacker to bypass the configured allow-list, enabling the inclusion of untrusted content in build outputs. Consequently, it may lead to SSRF behavior from the build environment, impacting internal network security. This issue has been addressed in version 5.104.0.

Affected Version(s)

webpack >= 5.49.0, < 5.104.0

References

https://github.com/webpack/webpack/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.