Vulnerabilities

TI-2026-79254 CVE-2026-114348

Host validation bypass in webpack-dev-server leaks stack traces

LOW 30

webpack-dev-server is a development server that provides live reloading for webpack projects.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00305 Published 2026-10-22 Fixed in 5.2.7, 6.1.0 CWE-1289

TI-2026-79248 CVE-2026-112085

Missing Origin checks on proxied WebSockets in webpack-dev-server

LOW 35

webpack-dev-server is a development server that provides live reloading for webpack projects.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00147 Published 2026-10-22 Fixed in 5.2.7, 6.1.0 CWE-1385

TI-2026-12328 CVE-2026-14631 · GHSA-m28w-2pqf-7qgj

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

LOW 31

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws end…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00517 Published 2026-07-03 Fixed in 5.2.6 CWE-20

TI-2026-12317 CVE-2026-14620 · GHSA-f5vj-f2hx-8m93

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

LOW 22

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without ve…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00521 Published 2026-07-03 Partial fix · 5.2.6 CWE-352

TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

LOW 29

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-06-15 Partial fix · 5.2.5 CWE-346

TI-2026-05619 CVE-2026-6402 · GHSA-79cf-xcqc-c78w

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

LOW 29

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00291 Published 2026-05-12 Partial fix · 5.2.4 CWE-749

TI-2025-21666 CVE-2025-30360 · GHSA-9jgg-88mc-972h

Origin validation error in webpack-dev-server

MEDIUM 62

webpack-dev-server allows users to use webpack with a development server that provides live reloading.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00357 Published 2025-06-03 Partial fix · 5.2.1 CWE-346

TI-2025-21665 CVE-2025-30359 · GHSA-4v9v-hfq4-rm2v

webpack-dev-server users' source code may be stolen when they access a malicious web site

MEDIUM 60

webpack-dev-server allows users to use webpack with a development server that provides live reloading.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00598 Published 2025-06-03 Partial fix · 5.2.1 CWE-749

TI-2018-10580 CVE-2018-14732 · GHSA-cf66-xwfp-gvc4

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.

LOW 38

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02486 Published 2018-09-21 Fixed in 3.1.11 CWE-20

Vulnerabilities

Filters