webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects (CVE-2025-68157)

In webpack versions >=5.49.0 and <5.104.0, when the experiments.buildHttp feature is enabled, the HttpUriPlugin's enforcement of allowedUris applies only to the initial HTTP(S) URL. If the initial request is redirected via HTTP 30x status codes, the plugin does not re-validate the redirected URL against the allowedUris list. This allows an attacker to bypass the allow-list policy by redirecting to URLs outside the trusted set. The vulnerability enables build-time server-side request forgery (SSRF) from the build machine to internal endpoints accessible via the network, and also allows untrusted content to be included in the build output as module source. The vulnerability has been patched in webpack version 5.104.0.

The vulnerability allows attackers to bypass the allowedUris policy during HTTP redirects, potentially causing the build process to fetch and include untrusted content. This can lead to build-time SSRF, where the build machine makes unauthorized requests to internal network endpoints, and inclusion of malicious or unintended code in the build output. The CVSS score is 3.7 (low severity), reflecting limited confidentiality and integrity impact and no availability impact.

Upgrade webpack to version 5.104.0 or later, where this vulnerability is patched. The patch ensures that allowedUris are re-validated after HTTP redirects, preventing bypass. No other mitigations are specifically required.