webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior (CVE-2025-68458)

Webpack's HTTP(S) resolver (HttpUriPlugin) in versions >=5.49.0 <5.104.1, when experiments.buildHttp is enabled, improperly validates allowedUris by relying on raw string prefix checks. Attackers can craft URLs containing userinfo components (e.g., username:password@host) that appear to match allowedUris but actually resolve to different hosts after URL parsing. This allows bypassing the allow-list, resulting in server-side request forgery (SSRF) during build time and inclusion of untrusted remote content as module source. The vulnerability is fixed in version 5.104.1.

An attacker controlling build inputs can cause webpack to make unauthorized outbound HTTP(S) requests from the build machine to internal or external hosts not intended by the allow-list. This can lead to SSRF attacks and inclusion of untrusted code in the build output, potentially compromising build integrity. The CVSS score is 3.7 (low severity) reflecting limited impact and attack complexity.

Upgrade webpack to version 5.104.1 or later where this vulnerability is patched. The vendor has provided an official fix. No other mitigations are indicated.