TI-2025-21666 Aliases CVE-2025-30360 GHSA-9jgg-88mc-972h

Origin validation error in webpack-dev-server

MEDIUM 62CWE-346Published 2025-06-03 · Updated 2025-06-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 25 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.

Summary

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00357 29th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial webpack-dev-server (webpack): 5.2.1webpack-dev-server (npm): 5.2.1Red Hat: 25 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
webpack	webpack-dev-server	before 5.2.1	5.2.1	Patch available	CNA
—	webpack-dev-server (npm)	before 5.2.1	5.2.1	Patch available	GHSA-9jgg-88mc-972h

webpack-dev-server Vendorwebpack Affected before 5.2.1 Fixed in 5.2.1 Patch available CNA
webpack-dev-server (npm) Vendor— Affected before 5.2.1 Fixed in 5.2.1 Patch available GHSA-9jgg-88mc-972h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:webpack.js:webpack-dev-server::::::::	before 5.2.1	Vulnerable	webpack

cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:* Versions before 5.2.1 Vulnerable ·webpack

Remediation

Fix · CNA webpack-dev-server (webpack) Fixed in 5.2.1
Fix · GHSA-9jgg-88mc-972h webpack-dev-server (npm) Fixed in 5.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Cryostat 4	Affected	No fix yet: Fix deferred
Migration Toolkit for Virtualization	Affected	No fix yet: Fix deferred
Network Observability Operator	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
OpenShift Pipelines	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Certification for Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat Discovery 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat Integration Camel K 1	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift distributed tracing 3	Affected	No fix yet: Fix deferred
Red Hat Process Automation 7	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix yet: Fix deferred
Red Hat Trusted Profile Analyzer	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 2	Affected	No fix yet: Fix deferred
Red Hat build of OptaPlanner 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-30360
2026-10-03 Alias added: GHSA-9jgg-88mc-972h
2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-30360

Other 3

TI-2025-21665 webpack-dev-server users' source code may be stolen when they access a malicious web site CVSS 3.1MEDIUM 5.9
TI-2018-10580 An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. CVSS 3.0HIGH 7.5
TI-2026-79248 Missing Origin checks on proxied WebSockets in webpack-dev-server CVSS 3.1HIGH 8.2
TI-2026-12328 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVSS 3.1MEDIUM 5.3
TI-2026-79254 Host validation bypass in webpack-dev-server leaks stack traces CVSS 3.1MEDIUM 5.3
TI-2026-08430 webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies CVSS 3.1MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences