{"action":"Upgrade webpack to 5.104.0 or later.","affected":[{"fixed":"5.104.0","introduced":"5.49.0"}],"component":"webpack","cve_ids":["CVE-2025-68157"],"ecosystem":"npm","epss":0.00233,"exploited":false,"fixed_versions":["5.104.0"],"ghsa_id":"GHSA-38r7-794h-5758","id":"tcs_01M5KEWPGEF3FPTCFGRXDV9YCX","modified_at":"2026-09-10T03:50:33.757470252Z","published_at":"2026-02-05T18:35:28Z","references":["https://osv.dev/vulnerability/GHSA-38r7-794h-5758","https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758","https://nvd.nist.gov/vuln/detail/CVE-2025-68157","https://github.com/webpack/webpack"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-38r7-794h-5758","url":"https://osv.dev/vulnerability/GHSA-38r7-794h-5758"}],"summary":"webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence"}