Bug 2437210 (CVE-2025-68157)

Summary:	CVE-2025-68157 webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aazores, abarbaro, abrianik, akostadi, alcohan, alizardo, amasferr, anjoseph, anpicker, anthomas, anujha, asoldano, bbaranow, bbrownin, bdettelb, bmaxwell, brian.stansberry, bstansbe, caswilli, chfoley, cmah, darran.lofthouse, dhanak, dlofthou, dmayorov, doconnor, dosoudil, drosa, dschmidt, eaguilar, ebaron, eborisov, ehelms, erezende, eric.wittmann, ewittman, ggainey, ggrzybek, gmalinko, gparvin, hasun, ibek, istudens, ivassile, iweiss, janstey, jbalunas, jcantril, jchui, jfula, jhe, jkoehler, jlanda, jlledo, jolong, jowilson, jpasqual, jprabhak, jraez, jrokos, jscholz, juwatts, jwong, kaycoth, kshier, ktsao, kverlaen, lball, lchilton, lphiri, manissin, mattdavi, mhulan, mnovotny, mosmerov, msvehla, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, oaljalju, omaciel, ometelka, osousa, pahickey, pantinor, parichar, pberan, pbizzarr, pcreech, pdelbell, pesilva, pjindal, pmackay, psrna, ptisnovs, rchan, rgodfrey, rhaigner, rhel-process-autobot, rkubis, rojacob, rstancel, rstepani, sausingh, sdawley, sfeifer, simaishi, smaestri, smallamp, smcdonal, stcannon, swoodman, syedriko, tasato, teagle, thjenkin, tmalecek, tom.jenkinson, tsedmik, ttakamiy, vdosoudi, veshanka, watson-tool-maintainers, wtam, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	An SSRF flaw has been discovered in Webpack. When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2437336, 2437338, 2437342, 2437348, 2437354, 2437360, 2437362, 2437366, 2437394, 2437396, 2437398, 2437400, 2437402, 2437407, 2437340, 2437344, 2437346, 2437350, 2437352, 2437356, 2437358, 2437364, 2437368, 2437370, 2437372, 2437374, 2437376, 2437378, 2437380, 2437382, 2437384, 2437386, 2437388, 2437390, 2437392, 2437404, 2437405, 2437406, 2437408, 2437409
Bug Blocks:

Description OSIDB Bzimport 2026-02-06 00:01:25 UTC

Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.