Is CVE-2025-68157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68157 being exploited in the wild.

How severe is CVE-2025-68157?

Low severity, with a CVSS score of 3.1, published 5 February 2026.

Which products and versions are affected?

webpack (npm) SEMVER:introduced=5.49.0,fixed=5.104.0.

Is there a fix for CVE-2025-68157?

Yes. webpack (npm): upgrade to 5.104.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68157 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-68157?

Check whether you run webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68157: webpack HttpUriPlugin allowedUris bypass via HTTP redirects

CVE-2025-68157 · Severity: low · CVSS 3.1 · Published 2026-02-05

webpack is a popular JavaScript bundler that developers use during the build process. When the experimental buildHttp feature is enabled, it has a security flaw where it doesn't properly verify allow-list restrictions when following HTTP redirects. An attacker with control over an allowed domain can redirect the build to fetch JavaScript from internal servers or external malicious sources, potentially allowing unauthorized access to internal systems (SSRF) or injecting malicious code into the final bundle. The fetched content is also cached, making the attack persistent.

Technologies: webpack (npm). Vendors: npm.

Quick answers

Is CVE-2025-68157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68157 being exploited in the wild.
How severe is CVE-2025-68157?: Low severity, with a CVSS score of 3.1, published 5 February 2026.
Which products and versions are affected?: webpack (npm) SEMVER:introduced=5.49.0,fixed=5.104.0.
Is there a fix for CVE-2025-68157?: Yes. webpack (npm): upgrade to 5.104.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68157 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-68157?: Check whether you run webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

webpack (npm): upgrade to 5.104.0 or later
```
npm install webpack@5.104.0
```

Technical details

The vulnerability exists in webpack's HTTP(S) resolver when experiments.buildHttp is enabled. The allowedUris validation is performed during the initial getInfo() call but is not re-checked when the HTTP resolver follows Location headers in 30x redirect responses. An attacker controlling an allowed host can issue a 302 redirect to any URL—either an internal-only service (SSRF) or attacker-controlled external site. The redirected content is treated as legitimate module source, bundled into the output, and persisted in the buildHttp cache. This enables both server-side request forgery from the build machine and code injection into the final bundle. Exploitation requires buildHttp to be explicitly enabled and the attacker to control (or find an open redirect on) an allowed domain. The vulnerability affects webpack versions ≥5.49.0 <5.104.0; version 5.104.0 patches the issue by re-validating allowedUris after redirects.

Affected products

webpack webpack >=5.49.0, <5.104.0

Identifiers

CVE-2025-68157
GHSA-38r7-794h-5758

Timeline

2026-02-05: disclosed
2026-02-05: patched: Version 5.104.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.