webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 15 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.
Summary
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Partial webpack-dev-server (webpack-dev-server): 5.2.5webpack-dev-server (npm): 5.2.5Red Hat: 17 advisoriesRed Hat: 15 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| webpack | webpack-dev-server | before 5.2.5 | 5.2.5 | Patch available | CNA |
| — | webpack-dev-server (npm) | before 5.2.5 | 5.2.5 | Patch available | GHSA-mx8g-39q3-5c79 |
- webpack-dev-server Vendorwebpack Affected before 5.2.5 Fixed in 5.2.5 Patch available CNA
- webpack-dev-server (npm) Vendor— Affected before 5.2.5 Fixed in 5.2.5 Patch available GHSA-mx8g-39q3-5c79
Remediation
- Fix · CNA webpack-dev-server (webpack-dev-server) Fixed in 5.2.5
- Fix · GHSA-mx8g-39q3-5c79 webpack-dev-server (npm) Fixed in 5.2.5 Advisory →
Red Hat 17 advisories
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:57408 Released 2026-08-26 · Red Hat rating ImportantOpenShift Container Platform 4.19.44 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9 +9
Show 14 more Red Hat advisories
- RHSA-2026:59155 Released 2026-08-24 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
- RHSA-2026:59153 Released 2026-08-24 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:56357 Released 2026-08-18 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:56338 Released 2026-08-18 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:54760 Released 2026-08-13 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:51038 Released 2026-08-11 · Red Hat rating ImportantOpenShift Container Platform 4.22.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9 +4
- RHSA-2026:50479 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
- RHSA-2026:50357 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:37628 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.20.29 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:37186 Released 2026-07-14 · Red Hat rating ImportantOpenShift Container Platform 4.21.24 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:34794 Released 2026-07-07 · Red Hat rating ImportantOpenShift Container Platform 4.22.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix planned: Will not fix |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Ansible Automation Platform 2.1 | Fixed | RHSA-2026:56338 |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:56357 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:50357 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:50479, RHSA-2026:59155 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:59153 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:54760 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:57408 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:37628 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:37186 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:34794, RHSA-2026:51038 |
Not affected: 23 products
- Cryostat 4
- Gatekeeper 3
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Developer Hub 1
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Virtualization 4
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9595
- 2026-10-03 Alias added: GHSA-mx8g-39q3-5c79
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Patch 3
Advisory 3
More Webpack-dev-server vulnerabilities
- TI-2025-21666 Origin validation error in webpack-dev-server CVSS 3.1MEDIUM 6.5
- TI-2025-21665 webpack-dev-server users' source code may be stolen when they access a malicious web site CVSS 3.1MEDIUM 5.9
- TI-2018-10580 An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. CVSS 3.0HIGH 7.5
- TI-2026-79248 Missing Origin checks on proxied WebSockets in webpack-dev-server CVSS 3.1HIGH 8.2
- TI-2026-12328 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVSS 3.1MEDIUM 5.3
- TI-2026-79254 Host validation bypass in webpack-dev-server leaks stack traces CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-9595 · CVE Program
- CVE-2026-9595 · NVD
- FIRST EPSS
- GHSA-mx8g-39q3-5c79 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-9595 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences