GHSA-8fgc-7cc6-rx7x
Low · 3.7CVSS
3.7
EPSS
—
Published
Feb 5, 2026
CISA due date
—
The record
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | webpack | 5.49.0 | 5.104.1 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r10 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r10 |
| Chainguard | langfuse-3 | 0 | 3.155.1-r2 |
| Chainguard | langfuse-3-worker | 0 | 3.155.1-r2 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r14 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r14 |
| Chainguard | langfuse-fips-3 | 0 | 3.155.1-r2 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.155.1-r2 |
| Chainguard | librechat | 0 | 0.8.2-r2 |
| Wolfi | langfuse-3 | 0 | 3.155.1-r2 |
| Wolfi | langfuse-3-worker | 0 | 3.155.1-r2 |
Related vulnerabilities
- CVE-2025-68458 Webpack is a module bundler. Same vulnerability
- CVE-2025-68157 Webpack is a module bundler. Also affects webpack
- GHSA-38r7-794h-5758 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache… Also affects webpack
- CVE-2024-45812 Vite a frontend build tooling framework for javascript. Also affects webpack
- CVE-2024-45389 Pagefind, a fully static search library, initializes its dynamic JavaScript and… Also affects webpack
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects langfuse-2
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects langfuse-2