# Risk map — web-infra-dev/rspack

> Canonical page: https://codevetter.com/unpack/rspack/risk-map

# Risk map — web-infra-dev/rspack

Scanned commit 179a0934f3091463419827fc2767af07b2fd38ed (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The principal sensitive boundaries are executable build inputs, output deletion/writes, remote-resource fetching, and native-backed JavaScript lifetimes. Source contains protective conditions as well as compatibility limitations. The observations below are not confirmed vulnerabilities, and the single resource-exhaustion concern is explicitly a hypothesis. Partial inspection does not establish the absence of other guards or tests.
- Configuration loading invokes an external config loader with parameters, and plugins/loaders execute supplied functions; this is an execution trust boundary for build inputs. — [packages/rspack-cli/src/utils/loadConfig.ts#L21-32](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L21-L32) [packages/rspack/src/rspack.ts#L68-74](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L68-L74) [packages/rspack/src/loader-runner/index.ts#L1176-1195](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/loader-runner/index.ts#L1176-L1195)
- output.clean can recursively remove the configured output directory, while CLI outputPath resolves against cwd; these operations target configured filesystem locations rather than a repository-root confinement boundary. — [packages/rspack-cli/src/cli.ts#L218-222](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L218-L222) [crates/rspack_core/src/compiler/mod.rs#L578-606](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L578-L606)
- HTTP imports cross a network boundary guarded by allowed_uris; redirect validation permits only HTTP(S) and rechecks the target against allowed URIs. — [crates/rspack_plugin_schemes/src/http_uri/mod.rs#L30-43](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_plugin_schemes/src/http_uri/mod.rs#L30-L43) [crates/rspack_plugin_schemes/src/http_uri/mod.rs#L61-92](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_plugin_schemes/src/http_uri/mod.rs#L61-L92)
- Hypothesis: the inspected Node HTTP client may consume substantial memory for large or highly compressed responses because it decompresses streams, collects every chunk, and concatenates the body without a size limit visible in this function. (inferred) — [packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L64-95](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L64-L95)
- Native-backed class access depends on wrapper-specific stale-target policies and hook/loader execution windows; retained Compilation wrappers deliberately resolve to the latest native compilation after rebuild. — [.agents/BINDING.md#L35-76](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L35-L76) [.agents/BINDING.md#L80-98](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L80-L98)
- Native close extends a compiler reference to a static lifetime under an explicit N-API ownership argument, waits for in-flight work to become idle, and releases compiler-scoped callback handles in finally. — [crates/rspack_binding_api/src/lib.rs#L502-543](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/lib.rs#L502-L543) [crates/rspack_binding_api/src/compiler.rs#L52-69](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/compiler.rs#L52-L69)
- PluginDriver::new panics through expect when plugin.apply returns an error; Compiler.compile also documents that afterCompile ordering is driven from Rust, making plugin initialization and hook sequencing high-impact coupling points. — [crates/rspack_core/src/plugin/plugin_driver.rs#L43-57](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/plugin/plugin_driver.rs#L43-L57) [packages/rspack/src/Compiler.ts#L812-817](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L812-L817)
- New-cache compatibility exclusions and WASM cache-suite exclusions limit default validation; the WASM database is a no-op, so native persistence behavior must not be assumed for that target. — [tests/rspack-test/NewCache.test.mjs#L19-36](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/NewCache.test.mjs#L19-L36) [tests/rspack-test/rstack.config.mts#L34-44](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L34-L44) [crates/rspack_core/src/new_cache/db/mod.rs#L23-30](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/db/mod.rs#L23-L30)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)