Vulnerabilities

TI-2026-12328 CVE-2026-14631 · GHSA-m28w-2pqf-7qgj

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

LOW 31

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws end…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00517 Published 2026-07-03 Fixed in 5.2.6 CWE-20

TI-2026-12317 CVE-2026-14620 · GHSA-f5vj-f2hx-8m93

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

LOW 22

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without ve…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00521 Published 2026-07-03 Partial fix · 5.2.6 CWE-352

Vulnerabilities

Filters

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints