Description
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing.
Recommendation
Update the webpack package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.49.0, <= 5.104.0
- Patched version(s): 5.104.1
References
Could your website be exposed too?
SmartScanner can check your website for webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence - CVE-2025-68157
- axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
- Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
- hemmelig allows SSRF Filter bypass via Secret Request functionality - CVE-2025-69206
You might also like:
See something that needs correcting? Let us knowUpdated February 06, 2026