{"schemaVersion":3,"id":"CVE-2025-68157","aliases":["UBUNTU-CVE-2025-68157","DEBIAN-CVE-2025-68157","CGA-2984-v7fg-28q4","CGA-2p8g-mwfh-7whw","CGA-2wvc-pq8m-j284","CGA-35cw-jgxc-f7x9","CGA-3c2r-79fv-r483","CGA-56vc-4gv6-cffc","CGA-695x-wpxf-gxm8","CGA-9w3g-hrmv-7723","CGA-9x68-c97p-cpx4","CGA-cc9x-262r-8hx4","CGA-cf8x-rrg7-9w6x","CGA-cr3r-3f5m-qhxf","CGA-g5vq-v4gw-xm25","CGA-gr64-92gm-hfv9","CGA-gwqp-97f9-pcwq","CGA-hm5q-35wc-5qc7","CGA-j37c-wrqh-6g39","CGA-j4m6-v2xx-v44v","CGA-mv2q-ghvx-8fvc","CGA-pw49-qj57-q39p","CGA-qjqm-jv68-893j","CGA-v54j-5r5r-7rxg","CGA-xprg-7454-v5wh","CGA-xprh-wrgq-q252","GHSA-38r7-794h-5758","CGA-2764-wc2h-vrmq","CGA-2fqw-h8mf-cq4q","CGA-2p86-3j49-ch78","CGA-3464-wpm8-xjg6","CGA-37fr-vwv7-j527","CGA-3gvg-hvhr-gw9g","CGA-3mfr-5qx7-vc9g","CGA-3wwr-2j87-9m4f","CGA-3x7x-9w32-rx74","CGA-4282-4jfw-v38j","CGA-4r49-6fp6-q58j","CGA-5gq9-fx7c-pc64","CGA-5q3f-g78m-4c74","CGA-62q7-476q-rw9x","CGA-63vf-7m4f-44pj","CGA-68rf-5m2c-v5mm","CGA-6r65-pq76-8jf4","CGA-72x5-j466-xx3q","CGA-7gc7-w77v-7m8m","CGA-7mxj-28gw-qjqh","CGA-7p65-rxhr-38vx","CGA-7r5p-2h8f-2vfx","CGA-8q8c-xr7w-47gr","CGA-8rpw-jh72-4gx3","CGA-95pq-r6q5-j7mm","CGA-9g5p-9wxg-wv9p","CGA-9mfj-5chv-p34f","CGA-9qph-g9g8-48wx","CGA-9w49-3h23-hj5v","CGA-ch2w-j53c-mpg2","CGA-cpq7-562p-m33v","CGA-cqp4-wpvr-5mvj","CGA-cqr6-f2mp-3799","CGA-f29q-q544-wf84","CGA-f7ch-7vv9-f7p3","CGA-fjhf-ff3x-qwmq","CGA-fjp8-pxr8-4jqq","CGA-g5gm-4h4p-hhqx","CGA-hfcv-j839-phpv","CGA-hwqc-82fq-4j57","CGA-hxw2-g3r4-5j5p","CGA-j4gp-7954-m52q","CGA-j7h8-qrcr-3v32","CGA-jcv8-h2f3-xcwv","CGA-jhhv-w9x8-w949","CGA-m8qh-ccqr-jw2c","CGA-mcpx-xg5x-9p8r","CGA-mmrv-f6vw-7m7r","CGA-mmx4-84wq-p72g","CGA-mv4f-539x-xhhf","CGA-mwc6-f8gj-r8p6","CGA-p47q-wvqp-j6wh","CGA-pf87-2x55-wmw4","CGA-q24q-8hv8-5jq8","CGA-q8f2-jjhg-xxq9","CGA-qrqg-g3vm-phv7","CGA-r597-8x7h-cqx5","CGA-r5rm-xq53-mcvh","CGA-r9fg-p84c-64j8","CGA-vc3w-fcp5-whvj","CGA-vhgg-hmgf-qhh3","CGA-vjhr-2fg5-p4xj","CGA-vmrm-36hv-mc9j","CGA-vpq4-7j3f-xghr","CGA-vwhp-6g7c-6pcf","CGA-xf23-h3mp-8xqh","CGA-xgg4-gr9x-c2mr","CGA-xvq2-p4w7-mgrj","CGA-xvxf-64cm-583r","CGA-xxc9-j646-f56h"],"status":"published","duplicateOf":null,"title":null,"description":"Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.","dates":{"published":"2026-02-05T23:08:13.214Z","modified":"2026-02-06T19:29:14.352Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.7,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":3.1,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":3.1,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":3.1,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":3.1,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":3.1,"impact":4.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00233,"percentile":0.13301,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.025000000000000022,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00208},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00233,"percentile":0.13301}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00212,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00233,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00233,"percentile":0.13301}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_WEBPACK_WEBPACK","name":"Webpack","source":"github","url":"https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.11","name":"arangodb-3.11","label":"arangodb-3.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.11","purlType":"apk","versions":[{"text":"< 3.11.14.5-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.14.5-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.9.4-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.9.4-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"drupal-11.3","name":"drupal-11.3","label":"drupal-11.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/drupal-11.3","purlType":"apk","versions":[{"text":"< 11.3.13-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.3.13-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"< 19.0.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-earlystopping","name":"katib-earlystopping","label":"katib-earlystopping","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-earlystopping","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-goptuna-compat","name":"katib-suggestion-goptuna-compat","label":"katib-suggestion-goptuna-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-goptuna-compat","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-hyperband","name":"katib-suggestion-hyperband","label":"katib-suggestion-hyperband","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-hyperband","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-hyperopt","name":"katib-suggestion-hyperopt","label":"katib-suggestion-hyperopt","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-hyperopt","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null},{"text":"< 0.19.0-r40","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31 | < 0.19.0-r40","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-nas-darts","name":"katib-suggestion-nas-darts","label":"katib-suggestion-nas-darts","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-nas-darts","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-nas-enas","name":"katib-suggestion-nas-enas","label":"katib-suggestion-nas-enas","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-nas-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-optuna-enas","name":"katib-suggestion-optuna-enas","label":"katib-suggestion-optuna-enas","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-optuna-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-pbt-enas","name":"katib-suggestion-pbt-enas","label":"katib-suggestion-pbt-enas","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-pbt-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-suggestion-skopt-enas","name":"katib-suggestion-skopt-enas","label":"katib-suggestion-skopt-enas","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-suggestion-skopt-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"katib-tfevent-metricscollector","name":"katib-tfevent-metricscollector","label":"katib-tfevent-metricscollector","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/katib-tfevent-metricscollector","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2","name":"langfuse-2","label":"langfuse-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2","purlType":"apk","versions":[{"text":"< 2.95.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2","name":"langfuse-fips-2","label":"langfuse-fips-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2","purlType":"apk","versions":[{"text":"< 2.95.12-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152","name":"langfuse-fips-3.152","label":"langfuse-fips-3.152","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.2-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-earlystopping","name":"katib-earlystopping","label":"katib-earlystopping","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-earlystopping","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-goptuna-compat","name":"katib-suggestion-goptuna-compat","label":"katib-suggestion-goptuna-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-goptuna-compat","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-hyperband","name":"katib-suggestion-hyperband","label":"katib-suggestion-hyperband","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-hyperband","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-hyperopt","name":"katib-suggestion-hyperopt","label":"katib-suggestion-hyperopt","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-hyperopt","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null},{"text":"< 0.19.0-r40","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31 | < 0.19.0-r40","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-nas-darts","name":"katib-suggestion-nas-darts","label":"katib-suggestion-nas-darts","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-nas-darts","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-nas-enas","name":"katib-suggestion-nas-enas","label":"katib-suggestion-nas-enas","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-nas-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-optuna-enas","name":"katib-suggestion-optuna-enas","label":"katib-suggestion-optuna-enas","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-optuna-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-pbt-enas","name":"katib-suggestion-pbt-enas","label":"katib-suggestion-pbt-enas","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-pbt-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-suggestion-skopt-enas","name":"katib-suggestion-skopt-enas","label":"katib-suggestion-skopt-enas","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-suggestion-skopt-enas","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"katib-tfevent-metricscollector","name":"katib-tfevent-metricscollector","label":"katib-tfevent-metricscollector","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/katib-tfevent-metricscollector","purlType":"apk","versions":[{"text":"< 0.19.0-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0-r31","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"node-webpack","name":"node-webpack","label":"node-webpack","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-webpack","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 5.105.4+dfsg1+~cs15.13.23-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 5.105.4+dfsg1+~cs15.13.23-2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-webpack","name":"node-webpack","label":"node-webpack","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-webpack","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"webpack","name":"webpack","label":"webpack","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/webpack","purlType":"npm","versions":[{"text":"≥ 5.49.0, < 5.104.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.49.0, < 5.104.0","eol":null,"hubHref":null},{"vendor":"webpack","product":"webpack","name":"webpack","label":"webpack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.49.0, < 5.104.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.49.0, < 5.104.0","eol":null,"hubHref":"/vendor/webpack/webpack"},{"vendor":"webpack.js","product":"webpack","name":"webpack","label":"webpack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.49.0, < 5.104.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.49.0, < 5.104.0","eol":null,"hubHref":"/vendor/webpackjs/webpack"}],"affectedCount":63,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758","label":"github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68157","label":"ubuntu.com/security/CVE-2025-68157","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68157","label":"www.cve.org/CVERecord?id=CVE-2025-68157","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68157","label":"security-tracker.debian.org/tracker/CVE-2025-68157","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68157.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68157.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68157","label":"nvd.nist.gov/vuln/detail/CVE-2025-68157","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/webpack/webpack","label":"github.com/webpack/webpack","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-G927-HH9P-HJWV"]},"timeline":[{"kind":"published","date":"2026-02-05T23:08:13.214Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-06T19:29:14.352Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T05:24:52.436Z","stale":false,"partial":false}}