Skip to content
OpenAdvisories

Package · npm

webpack-dev-server

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-14631

    webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

    webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. T…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 4.7
    CVE-2026-14620 Public exploit

    webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated fro…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 5.3
    CVE-2026-9595

    webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend,…

    webpack-dev-server webpack-dev-server webpack-dev-server node-webpack Ubuntu npm
  • Medium 5.3
    CVE-2026-6402

    webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

    webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request heade…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 6.5
    CVE-2025-30360

    webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origi…

    webpack webpack-dev-server webpack-dev-server npm
  • Medium 5.3
    CVE-2025-30359

    webpack-dev-server users' source code may be stolen when they access a malicious web site

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by…

    webpack webpack-dev-server webpack-dev-server npm
  • High 7.5
    CVE-2018-14732

    Missing Origin Validation in webpack-dev-server

    An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive…

    webpack-dev-server npm