Priority LOW 30
webpack-dev-server is a development server that provides live reloading for webpack projects.
Vulnerabilities
17 records
Priority LOW 35
webpack-dev-server is a development server that provides live reloading for webpack projects.
TI-2026-12328 CVE-2026-14631 · GHSA-m28w-2pqf-7qgj
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Priority LOW 31
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws end…
TI-2026-12317 CVE-2026-14620 · GHSA-f5vj-f2hx-8m93
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Priority LOW 22
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without ve…
TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
TI-2026-05619 CVE-2026-6402 · GHSA-79cf-xcqc-c78w
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Priority LOW 29
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP.
TI-2025-41737 CVE-2025-68157 · GHSA-38r7-794h-5758
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
Priority MEDIUM 51
Webpack is a module bundler.
TI-2025-41991 CVE-2025-68458 · GHSA-8fgc-7cc6-rx7x
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Priority MEDIUM 51
Webpack is a module bundler.
TI-2025-21666 CVE-2025-30360 · GHSA-9jgg-88mc-972h
Origin validation error in webpack-dev-server
Priority MEDIUM 62
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
TI-2025-21665 CVE-2025-30359 · GHSA-4v9v-hfq4-rm2v
webpack-dev-server users' source code may be stolen when they access a malicious web site
Priority MEDIUM 60
webpack-dev-server allows users to use webpack with a development server that provides live reloading.
TI-2024-29382 CVE-2024-43788 · GHSA-4vvj-4cpr-p986
DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Priority MEDIUM 62
Webpack is a module bundler.
TI-2024-19349 CVE-2024-29180 · GHSA-wr3j-pwj9-hqq6
webpack-dev-middleware Path Traversal vulnerability
Priority HIGH 66
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.
TI-2023-12725 CVE-2023-28154 · GHSA-hc6q-2mpp-qw7j
Webpack 5 before 5.76.0 does not avoid cross-realm object access.
Priority MEDIUM 52
Webpack 5 before 5.76.0 does not avoid cross-realm object access.
TI-2022-17517 CVE-2022-37603 · GHSA-3rfm-jhwj-7488
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName…
Priority MEDIUM 44
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
TI-2022-17515 CVE-2022-37601 · GHSA-76p3-8jx3-jpfq
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack…
Priority HIGH 82
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.
TI-2022-17514 CVE-2022-37599 · GHSA-hhq3-ff78-jv3g
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName…
Priority LOW 38
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
TI-2018-10580 CVE-2018-14732 · GHSA-cf66-xwfp-gvc4
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.
Priority LOW 38
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.