CVE-2025-68157
1 advisory.
npm/webpack CVE-2025-68157: low 3.7, EPSS 0.23%
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Action: Upgrade webpack to 5.104.0 or later.
npm i webpack@5.104.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.49.0 | 5.104.0 | - |
Fixed versions
| 5.104.0 |
Sources
- osv: GHSA-38r7-794h-5758
- https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758
- https://nvd.nist.gov/vuln/detail/CVE-2025-68157
- https://github.com/webpack/webpack
CVE-2025-68157 · published · modified · JSON