Read the docs
TI-2026-12328 Aliases CVE-2026-14631GHSA-m28w-2pqf-7qgj

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed webpack-dev-server (webpack-dev-server): 5.2.6webpack-dev-server (npm): 5.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
webpackwebpack-dev-serverbefore 5.2.65.2.6Patch availableCNA
—webpack-dev-server (npm)before 5.2.65.2.6Patch availableGHSA-m28w-2pqf-7qgj
  • webpack-dev-server Vendorwebpack Affected before 5.2.6 Fixed in 5.2.6 Patch available CNA
  • webpack-dev-server (npm) Vendor— Affected before 5.2.6 Fixed in 5.2.6 Patch available GHSA-m28w-2pqf-7qgj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*before 5.2.6Vulnerablewebpack
  • cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:* Versions before 5.2.6 Vulnerable ·webpack

Remediation

  • Fix · CNA webpack-dev-server (webpack-dev-server) Fixed in 5.2.6
  • Fix · GHSA-m28w-2pqf-7qgj webpack-dev-server (npm) Fixed in 5.2.6 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    webpack-dev-server 5.2.6

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-12317 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsPriority LOW 22
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 26 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Containers
  • Node HealthCheck Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Connectivity Link 1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14631
  2. 2026-10-03 Alias added: GHSA-m28w-2pqf-7qgj
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 3

  • TI-2025-21666 Origin validation error in webpack-dev-server CVSS 3.1MEDIUM 6.5
  • TI-2025-21665 webpack-dev-server users' source code may be stolen when they access a malicious web site CVSS 3.1MEDIUM 5.9
  • TI-2018-10580 An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. CVSS 3.0HIGH 7.5
  • TI-2026-79248 Missing Origin checks on proxied WebSockets in webpack-dev-server CVSS 3.1HIGH 8.2
  • TI-2026-79254 Host validation bypass in webpack-dev-server leaks stack traces CVSS 3.1MEDIUM 5.3
  • TI-2026-08430 webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences