CVE-2025-68157: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68157 is an allow-list bypass vulnerability in webpack's buildHttp feature (HttpUriPlugin) that enables Server-Side Request Forgery (SSRF) behavior at build time and untrusted content inclusion in build outputs. It affects webpack versions 5.49.0 through 5.103.x (fixed in 5.104.0) for Node.js. The vulnerability was published on February 5, 2026, with a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause (CWE-918: SSRF) lies in webpack's HttpUriPlugin, which enforces the allowedUris allow-list only when metadata is created for the initial request URL (via getInfo()), but does not re-validate the allow-list after following HTTP 30x redirects. An attacker who can influence imported URLs — through source code contributions, dependency manipulation, or configuration changes — and who can cause an allowed endpoint to issue a redirect (e.g., via an open redirect) can point the build process to arbitrary internal or external URLs. The redirected response is then consumed as module source, bundled into the build output, and persisted in the buildHttp cache. A public proof-of-concept demonstrating the bypass using localhost services is included in the official advisory (Github Advisory).

Successful exploitation allows an attacker to trigger network requests from the build machine to internal-only services (SSRF), bundle content from outside the allow-list into build outputs, and persist fetched responses in build artifacts such as the buildHttp cache — increasing the risk of later data exfiltration. If the redirect target is attacker-controlled, attacker-supplied JavaScript can be bundled and subsequently executed when the resulting bundle runs in production, compromising both build integrity and end-user environments. Confidentiality and integrity are both partially impacted; availability is unaffected (Github Advisory).

A public proof-of-concept is available in the official webpack security advisory, demonstrating the SSRF bypass using localhost services. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.008% (2nd percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a vulnerable target: Confirm the target project uses webpack 5.49.0–5.103.x with experiments.buildHttp enabled and allowedUris configured as a security boundary.
2. Gain influence over imported URLs: Obtain the ability to modify source files, dependencies, or webpack configuration — for example, via a pull request, a compromised dependency, or direct repository access.
3. Identify or create an open redirect on an allowed host: Find an endpoint within the allowedUris allow-list that issues HTTP 30x redirects, or introduce one via a dependency or configuration change.
4. Craft a malicious import: Add an import statement in the project source that references the allowed host's redirect endpoint, with the redirect target pointing to an internal-only service or attacker-controlled server (e.g., import { secret } from 'http://allowed-host/redirect.js?to=http://internal-service/secret.js').
5. Trigger the build: Cause the webpack build to run (e.g., via CI/CD pipeline or developer build). The HttpUriPlugin fetches the allowed URL, follows the redirect without re-checking allowedUris, and fetches the internal/attacker-controlled resource.
6. Collect results: The internal resource's content is bundled into the build output and persisted in the buildHttp cache and lockfile, enabling exfiltration of internal data or injection of attacker-controlled JavaScript into the bundle (Github Advisory).

• Network: Unexpected outbound HTTP requests from the build machine to internal-only IP addresses or services during webpack build execution; HTTP requests to internal endpoints (e.g., http://127.0.0.1:<port>/) originating from the build process.
• File System: Presence of unexpected or sensitive content (e.g., internal secrets, non-allow-listed module code) in webpack build output files (e.g., bundle.js, dist/); unexpected entries in the buildHttp cache directory (e.g., .buildHttp-cache/) or webpack.lock lockfile containing content from non-allow-listed URLs.
• Logs: Build logs showing HTTP fetch activity to URLs not present in the configured allowedUris list; webpack build logs referencing redirect chains (HTTP 302 responses) to internal or external hosts.
• Process: Webpack build process making network connections to internal services or unexpected external hosts during the module resolution phase (Github Advisory).

Update webpack to version 5.104.0 or later, which re-validates allowedUris after following HTTP redirects. If an immediate upgrade is not possible, disable experiments.buildHttp entirely if it is not required for the build process. Additionally, restrict source contributions and dependency modifications to trusted parties, and implement network-level controls on build machines to block outbound connections to internal services. Monitor and validate all redirect targets to ensure they remain within the configured security boundary (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher HanJeouk and reviewed for remediation by webpack maintainer alexander-akait, with the fix published in webpack 5.104.0 on February 5, 2026. Red Hat tracked the issue as low severity across numerous dependent products. IBM subsequently issued security bulletins for multiple affected products including IBM API Connect, IBM Guardium Data Security Center, IBM watsonx Orchestrate, and IBM Cloud Pak for Data (Github Advisory, Red Hat Bugzilla).