{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T18:52:48.851","vulnerabilities":[{"cve":{"id":"CVE-2025-68157","sourceIdentifier":"security-advisories@github.com","published":"2026-02-05T23:15:53.777","lastModified":"2026-02-13T19:21:27.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0."},{"lang":"es","value":"Webpack es un empaquetador de módulos. Desde la versión 5.49.0 hasta antes de la 5.104.0, cuando experiments.buildHttp está habilitado, el resolvedor HTTP(S) de webpack (HttpUriPlugin) aplica allowedUris solo para la URL inicial, pero no vuelve a validar allowedUris después de seguir redirecciones HTTP 30x. Como resultado, una importación que parece restringida a una lista de permitidos de confianza puede ser redirigida a URLs HTTP(S) fuera de la lista de permitidos. Esto es una omisión de política/lista de permitidos que habilita el comportamiento SSRF en tiempo de compilación (solicitudes desde la máquina de compilación a puntos finales solo internos, dependiendo del acceso a la red) y la inclusión de contenido no confiable en las salidas de compilación (el contenido redirigido se trata como fuente de módulo y se empaqueta). Este problema ha sido parcheado en la versión 5.104.0."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:*","versionStartIncluding":"5.49.0","versionEndExcluding":"5.104.0","matchCriteriaId":"ADA354B0-6A76-4EF0-B94E-51DA67B927C1"}]}]}],"references":[{"url":"https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}