Policy Bypass Vulnerability in Webpack by OpenJS Foundation
CVE-2025-68458

3.7LOW

Key Information:

Vendor

Webpack

Status
Webpack
Vendor
CVE Published:
5 February 2026

What is CVE-2025-68458?

A policy/allow-list bypass vulnerability has been identified in Webpack, affecting versions from 5.49.0 to before 5.104.1. When the experiments.buildHttp feature is enabled, attackers can exploit the HttpUriPlugin to bypass the HTTP(S) resolver. This may allow unauthorized access to resources from external hosts by crafting specific URLs that include user credentials. The vulnerability exploits inadequate string prefix checks in allowUris enforcement, potentially leading to SSRF attacks and the inclusion of untrusted content during the build process. The issue has been rectified in version 5.104.1.

Affected Version(s)

webpack >= 5.49.0, < 5.104.1

References

https://github.com/webpack/webpack/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.