{"action":"Upgrade webpack to 5.104.1 or later.","affected":[{"fixed":"5.104.1","introduced":"5.49.0"}],"component":"webpack","cve_ids":["CVE-2025-68458"],"ecosystem":"npm","epss":0.00233,"exploited":false,"fixed_versions":["5.104.1"],"ghsa_id":"GHSA-8fgc-7cc6-rx7x","id":"tcs_01M5KFCQNDW001XGF2G4PE344X","modified_at":"2026-09-10T03:50:34.472343977Z","published_at":"2026-02-05T18:38:10Z","references":["https://osv.dev/vulnerability/GHSA-8fgc-7cc6-rx7x","https://github.com/webpack/webpack/security/advisories/GHSA-8fgc-7cc6-rx7x","https://nvd.nist.gov/vuln/detail/CVE-2025-68458","https://github.com/webpack/webpack"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-8fgc-7cc6-rx7x","url":"https://osv.dev/vulnerability/GHSA-8fgc-7cc6-rx7x"}],"summary":"webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior"}