TI-2025-21666 CVE-2025-30360 · GHSA-9jgg-88mc-972h
Origin validation error in webpack-dev-server
Priority MEDIUM 62
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
webpack
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
webpack records in CISA KEVNo webpack vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Webpack-dev-server · all components
TI-2025-21665 CVE-2025-30359 · GHSA-4v9v-hfq4-rm2v
webpack-dev-server users' source code may be stolen when they access a malicious web site
Priority MEDIUM 60
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
TI-2018-10580 CVE-2018-14732 · GHSA-cf66-xwfp-gvc4
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.
Priority LOW 38
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.
Priority LOW 35
webpack-dev-server is a development server that provides live reloading for webpack projects.
TI-2026-12328 CVE-2026-14631 · GHSA-m28w-2pqf-7qgj
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Priority LOW 31
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws end…
Priority LOW 30
webpack-dev-server is a development server that provides live reloading for webpack projects.
TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
TI-2026-05619 CVE-2026-6402 · GHSA-79cf-xcqc-c78w
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Priority LOW 29
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP.
TI-2026-12317 CVE-2026-14620 · GHSA-f5vj-f2hx-8m93
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Priority LOW 22
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without ve…